AWS generative AI interview questions: Bedrock, AgentCore

• Frame first: slices of cases, a bar per slice, and autonomy per action. Refunds stay with a named approver until evidence says otherwise.
• The agent: a Strands agent calling models on Amazon Bedrock through the Converse API with an inference profile; tools that are exact code where the work is exact.
• Hosting: AgentCore Runtime, where each session runs in its own microVM with isolated CPU, memory and filesystem; AgentCore Memory for context that must outlive a session.
• Tools: existing APIs and Lambda functions exposed as MCP tools through AgentCore Gateway; outbound credentials held by AgentCore Identity, outside the model's context.
• Knowledge: Bedrock Knowledge Bases over the policy corpus, with citations kept from each result's source.
• Safety: Bedrock Guardrails for harmful content, prompt attacks and PII masking, and, separately, refund limits in the refund tool's signature with an approval token.
• Operations: AgentCore Observability traces in CloudWatch, model invocation logging, cost tags per feature, a budget alarm.
• The insight: Guardrails filter content; they do not decide what an agent may do. Authority over actions is always the design's job.

The follow-up: "An auditor asks why a refund was issued." → the trace: the retrieved passages, the tool calls, the approval record, stored with the decision.

Red flag: a list of services with no limit on any action.

• Strands Agents is an open-source SDK with a model-driven loop: tools are decorated functions whose docstrings and type hints become their descriptions and schemas, with multi-agent patterns (agents as tools, graphs and swarms) that compose.
• Bedrock Agents is a managed agent: configured action groups and knowledge bases, orchestration run by the service.
• AgentCore is not a framework at all: it is the infrastructure to deploy and operate agents (Runtime, Memory, Gateway, Identity, Observability) and it is framework-agnostic.
• LangGraph is a graph-based orchestration framework for explicit, stateful flows.
• Choose by how much control and determinism you need, and how much portability; they combine: a Strands or LangGraph agent can run on AgentCore Runtime.
• The insight: "framework or platform?" is a false choice; the real decision is which parts are portable (the loop, the tools, the evaluation) and which are not.

The follow-up: "How locked in are we?" → itemise it: agent logic, tool design and evaluation move; the platform layer does not.

Red flag: treating AgentCore and Strands as competitors.

• ValidationException on the model ID: many models must be called through an inference profile ID with a geography prefix, such as us., rather than the bare model ID.
• AccessDeniedException: model access not enabled in the region; or IAM that allows the inference profile but not the foundation model in every destination region. Bedrock authorises the profile, the model in the source region and the model in each candidate destination region.
• Service control policies: a region allowlist that omits a destination region breaks cross-region inference, unless it carries an exception using the bedrock:InferenceProfileArn condition key.
• Also check the right client: bedrock-runtime for inference, not bedrock.
• The insight: a missing destination-region permission fails only when a request is routed there, so the error looks intermittent.

The follow-up: "It fails about one call in three." → requests routed to a region the IAM policy or SCP does not allow.

Red flag: "wait and retry."

• An identity per tool, not per agent: the booking lookup can read one table; the drafting tool needs no AWS permissions at all.
• AgentCore Identity for outbound access: OAuth tokens and API keys held in a token vault and retrieved by the agent's workload identity, so credentials never enter the model's context.
• AgentCore Gateway for tool exposure, with authentication on the way in and out.
• Private networking through VPC endpoints where the data requires it; encryption keys under your control; CloudTrail for every API call.
• Consequential actions behind caps and approvals in the tool itself.
• The insight: if the only thing standing between the agent and a destructive action is a sentence in a prompt, there is no control.

The follow-up: "The agent needs to act as the signed-in user." → delegated OAuth through the token vault, scoped to that user, with consent.

Red flag: one broad role for the whole agent.

• Knowledge Bases handle ingestion, chunking, embeddings and retrieval. The default chunking is fixed-size, 300 tokens with 20% overlap; there are fixed-size, hierarchical, semantic and no-chunking options.
• Choose chunking deliberately: it cannot be changed after the data source is connected.
• Retrieve, then generate, with metadata filters and a reranker model to reorder results; keep each result's source location for citations.
• Know the vector store's billing: a classic OpenSearch Serverless collection bills a minimum capacity whether or not it is queried, while newer collection types can scale to zero.
• Build your own pipeline when you need control the managed service does not give: custom ranking, unusual sources, or a store you already run.
• The insight: retrieval recall at k is measured, not assumed; top-k and chunk size are usually set by habit.

The follow-up: "Answers are wrong and the right document is in the corpus." → retrieval or generation? Check whether the passage was retrieved before changing the prompt.

Red flag: changing the model to fix retrieval.

• Measure per case: tokens per call, share on the expensive model, cache hit ratio, attempts.
• Prompt caching: explicit cache checkpoints on stable content first, a model-specific minimum number of tokens per checkpoint, up to four checkpoints, and a five-minute lifetime, or an hour on some models.
• Batch inference for work that is not real-time: select models are priced 50% below on-demand.
• Service tiers trade availability and latency for cost without changing the model; route easy calls to smaller models.
• AgentCore Runtime bills per second for CPU and memory consumed: CPU drops to zero while waiting on the model or tools, but memory stays billable until the session ends, so the idle timeout is a cost lever.
• The insight: a timestamp at the top of a system prompt silently defeats caching; the fix is ordering, not spending.

The follow-up: "Finance wants a hard monthly cap." → budgets and alarms for visibility, and per-task token and loop caps for control.

Red flag: "negotiate a discount" as the first move.

• Cross-region inference profiles spread requests: geographic profiles keep processing within a geography, global profiles route more widely. It is a data-residency decision as much as a capacity one.
• Quotas are per model and region: know them, request increases ahead of launches, and consider reserved capacity where throughput must be guaranteed.
• Retries with backoff and jitter, a circuit breaker, and a queue for work that can wait.
• Fallback models, logged: a fallback to a larger model is a cost cliff and to a smaller one a quiet quality drop, so record the answering model on every response.
• Degrade gracefully: route to people when capacity is exhausted, rather than failing silently.
• The insight: resilience for AI workloads has a quality dimension that ordinary failover does not.

The follow-up: "Data must stay in the EU." → a geographic EU profile, and permissions and SCPs that allow its destination regions.

Red flag: "multi-region active-active" with no mention of quotas or data residency.

• AgentCore Observability traces agent steps with OpenTelemetry into CloudWatch; CloudWatch Transaction Search must be enabled once per account before spans appear, and agent code adds the AWS Distro for OpenTelemetry.
• Model invocation logging and Bedrock's CloudWatch metrics for tokens, latency and throttles.
• Three vital signs: the answering model on every response, the abstention rate daily, and the cost per task daily.
• Return a trace ID to the caller, so any complaint maps to a trace.
• The insight: "the traces are empty" is usually the account-level setup, not the code.

The follow-up: "Quality dropped with no deploy." → which model answered, and what changed in the inputs or the index?

Red flag: "we check the logs when something breaks."

• Memory and retention: what is kept per session and long term, and for how long; long-term extraction is asynchronous, so the current session relies on short-term memory.
• Identity per tool, and what the gateway exposes publicly.
• Session lifecycle: an idle timeout (15 minutes by default) and a maximum lifetime (up to 8 hours on microVMs); session state is ephemeral, so durable context goes to Memory.
• The response contract: the answer, the answering model and the trace ID.
• Teardown: runtimes, gateways, memory stores and their log groups deleted with the stack.
• The insight: the entrypoint should be a thin adapter; everything worth testing lives in the agent and its tools, where it runs the same on a laptop and in the runtime.

The follow-up: "A session needs to run all day." → check the compute type's limits, or persist the work and resume in a new session.

Red flag: deploying without a retention decision.

• Operational excellence: evaluations in CI per slice, prompts and model versions as deployable artefacts, runbooks with timed rollbacks.
• Security: least privilege per tool, credentials outside the model, prompt-injection testing on every change, PII masking.
• Reliability: quotas, cross-region inference, retries, graceful degradation to people.
• Performance efficiency: the model, tool and orchestration clocks; caching; the right model per slice.
• Cost optimisation: cost per task, caching, batch where latency allows, routing by difficulty.
• Sustainability: smaller models and fewer tokens for the same outcome.
• The insight: AWS publishes a Well-Architected Generative AI Lens; citing it and then adding what no lens decides for you (the bar per slice and authority per action) is the senior answer.

The follow-up: "Which pillar do teams neglect most?" → cost per task, until the first bill.

Red flag: reciting pillar names with no AI-specific practice.