The correct choice is Configure Guardrails for Amazon Bedrock to block PII in outputs and create Amazon CloudWatch alarms. This option both prevents PII from being returned by the model and provides alerting when a guardrail is triggered.

Guardrails for Amazon Bedrock enforce safety policies at generation time so outputs containing PII can be blocked or redacted before they reach users. You can pair Guardrails for Amazon Bedrock with Amazon CloudWatch alarms to generate operational alerts and create workflows for incident response when a policy violation occurs.

Enable AWS CloudTrail to record Bedrock API activity and trigger alerts when PII appears is incorrect because Enable AWS CloudTrail to record Bedrock API activity and trigger alerts when PII appears only provides API call logging and auditing. CloudTrail does not inspect or filter the textual content of model responses in real time.

Send model outputs to Amazon S3 and use Amazon Macie to detect sensitive data with alerts is incorrect because Send model outputs to Amazon S3 and use Amazon Macie to detect sensitive data with alerts focuses on data at rest and post processing. Macie can find sensitive data in S3 but it does not prevent PII from being generated or deliver real time enforcement at response time.

Use Amazon Comprehend PII entity detection to redact sensitive text in model responses is not the best choice because Use Amazon Comprehend PII entity detection to redact sensitive text in model responses can detect and redact entities but it lacks the integrated prevention and centralized policy enforcement that Guardrails for Amazon Bedrock provide. That makes Comprehend suitable for layered detection but not a full replacement for Guardrails when prevention is required.

Full AWS Practitioner Certification Question