A financial services company uses Amazon Bedrock to analyze customer data that is stored in...

Option A is correct because Amazon Bedrock Guardrails provides a native sensitive-information filter for personally identifiable information. The filter can detect supported PII types and use the MASK action so detected values in model requests or responses are replaced with placeholders such as the PII type. This directly satisfies the requirement to mask PII from foundation model responses with minimal operational effort. It avoids creating and maintaining an additional preprocessing pipeline. Option B can detect or redact PII with Amazon Comprehend, but it requires Lambda logic and data-processing workflows before Bedrock invocation. Options C and D require scanning, copying, and segregating objects across S3 buckets and still do not directly enforce response masking. For response-level protection in Bedrock, the managed Guardrails capability is the simplest and most purpose-built control. AWS Documentation

================