MLA-C01 Practice Test 46 — 15 Questions

Question 1

A data engineer stores a training dataset in Amazon S3 across a prefix hierarchy organized by year, month, and day, and analysts query it with Amazon Athena. The engineer wants Athena to scan only the relevant date range instead of the entire dataset. Which action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the S3 prefix structure as partition columns in the table and query with a WHERE clause on those columns.. Athena reduces cost and latency by reading only the partitions that satisfy the query predicate. When the S3 layout already encodes year, month, and day, exposing those levels as partition columns in the table definition lets a WHERE filter on those columns prune the scan to the matching prefixes. The engineer should register the partitions and query against the partition keys rather than scanning the whole dataset.

Answer

Enable S3 Transfer Acceleration on the bucket to speed up object retrieval during queries.

Answer

Convert the dataset to JSON and rely on Athena schema-on-read to skip irrelevant records.

Answer

Store the data as a single large uncompressed CSV object so Athena reads it sequentially.

Question 2

A fraud-detection team trains a model in SageMaker and wants to shift 10 percent of live prediction traffic to a newly retrained model to compare accuracy before a full cutover. The endpoint already serves the current model on one production variant. They need the endpoint to route a controlled fraction of requests to the new model without changing the client application. What should they do?

Accepted Answer

Update the existing endpoint to add a second production variant for the retrained model and set its initial variant weight to 10 while the original variant keeps 90.. Production variants with weights are the native SageMaker mechanism for sending a percentage of live traffic to a new model on the same endpoint. Adding a variant for the retrained model and assigning it a weight of 10 while the incumbent holds 90 yields a canary deployment that clients see as a single endpoint. Weights can be adjusted as confidence grows and the old variant removed at full cutover.

Answer

Enable an inference pipeline on the endpoint and place the retrained model as the second container in the pipeline.

Answer

Use a SageMaker batch transform job against the live traffic stream to score 10 percent of requests with the retrained model.

Answer

Create a new endpoint for the retrained model and use Route 53 weighted routing to send 10 percent of DNS queries to the new endpoint.

Question 3

A financial services company has a SageMaker real-time endpoint serving a fraud detection model. Compliance requires that all inference requests and responses be logged with the ability to detect anomalous input feature distributions over time. The team wants a managed solution that captures request/response payloads to Amazon S3 and automatically computes statistics and constraints against a baseline. Which combination of SageMaker features should they enable?

Accepted Answer

Enable SageMaker Model Monitor data capture on the endpoint and schedule a monitoring job using the baseline constraints and statistics.. SageMaker Model Monitor is the managed service for monitoring deployed models. Data capture stores inference request and response data in S3, and monitoring schedules compare that data to a baseline to detect data drift, model quality issues, bias, and feature attribution drift. This provides both the audit trail and the automated anomaly detection required.

Answer

Configure the endpoint to write inference logs to Amazon CloudWatch Logs and create a custom Lambda function to parse and analyze the logs.

Answer

Enable SageMaker Debugger on the endpoint and configure rules to monitor for data drift.

Answer

Enable AWS CloudTrail data events on the S3 bucket used by the endpoint and configure Amazon CloudWatch Logs metric filters.

Question 4

A retail company runs a SageMaker real-time endpoint serving a demand forecasting model. Security policy requires that all inference requests travel over the AWS private network and never traverse the public internet, and that the endpoint cannot be invoked from outside the company VPC. The endpoint already uses a customer-managed KMS key for volume encryption. Which TWO configurations should the engineer apply to meet these requirements? (Choose two.)

Accepted Answer

Set the endpoint's network access type to VPC-only by attaching the appropriate VPC configuration so the endpoint is reachable only from the specified subnets and security groups.. Keeping inference traffic on the AWS private network and blocking external invocation requires two complementary controls. An interface VPC endpoint for the SageMaker runtime lets InvokeEndpoint calls resolve to a private IP inside the VPC, and configuring the endpoint for VPC-only network access restricts reachability to the specified subnets and security groups. IAM policies, network isolation, and data capture do not change the request path or prevent public invocation.

Answer

Configure the endpoint with EnableNetworkIsolation set to true so the container cannot make outbound network calls.

Answer

Enable request and response data capture on the endpoint and store the captures in an S3 bucket with a bucket policy that allows only the VPC endpoint.

Answer

Attach an IAM resource policy to the endpoint that denies all principals except the account root, and enable AWS CloudTrail data events on the endpoint.

Question 5

A retail company stores training datasets, model artifacts, and feature data in Amazon S3. An auditor requires that all objects be encrypted at rest with keys the company controls and that key usage be independently auditable. The team wants minimal operational overhead. Which approach should the ML engineer recommend?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer-managed keys (SSE-KMS) and enable AWS CloudTrail data events for the bucket.. SSE-KMS with customer-managed keys gives the company control over key policies, rotation, and access grants while offloading cryptographic operations to AWS. CloudTrail data events record object-level S3 activity, and KMS key usage is logged separately, providing the independent audit trail the auditor requires. SSE-S3, client-side encryption with local keys, and versioning do not meet the customer-controlled key requirement.

Answer

Enable default bucket encryption with SSE-S3 and rely on S3 Versioning to protect against unauthorized changes.

Answer

Use S3 client-side encryption with a key stored in the application's configuration file and rotate it manually each quarter.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and enable S3 access logging.

Question 6

A healthcare analytics team trains models in SageMaker and stores artifacts in an S3 bucket that contains protected health information. An auditor asks how the team can prove which training dataset and container image produced the model currently deployed to production, and wants the evidence retained even if someone deletes the training job. Which SageMaker capability should the team rely on to capture and retain this metadata automatically?

Accepted Answer

SageMaker ML Lineage Tracking, which automatically records entities and associations such as datasets, training jobs, and model artifacts as the workflow runs.. ML Lineage Tracking automatically builds a graph of entities and associations across the ML workflow, linking datasets, training jobs, and model artifacts. This graph persists independently of the training job, so the team can trace the deployed model back to its inputs and container image even after the job is deleted, which is exactly the durable provenance an auditor needs.

Answer

SageMaker Model Registry, which stores model versions and their approval status but does not capture dataset or container provenance automatically.

Answer

SageMaker Experiments, which groups runs and logs metrics and parameters but does not persist a provenance graph after the trial components are deleted.

Answer

AWS CloudTrail management events, which record API calls such as CreateTrainingJob and CreateModel and can be queried for who performed each action.

Question 7

A financial services company must ensure that a SageMaker model deployed to a real-time endpoint only produces predictions consistent with a fairness constraint on a protected attribute, and that any violation is detected within minutes and triggers an alert to the compliance team. The model is already deployed and monitored for data quality. Which approach should the machine learning engineer implement?

Accepted Answer

Enable SageMaker Model Monitor with a bias drift baseline created by SageMaker Clarify, schedule the monitoring job to run every few minutes, and configure CloudWatch alarms on the bias metrics.. Bias drift monitoring in Model Monitor compares live predictions against a Clarify-generated bias baseline that encodes the fairness constraint, computing metrics on captured data. Running the job frequently yields detection within minutes, and publishing those metrics to CloudWatch enables alarms that notify compliance. Explainability, data quality, and registry gating do not evaluate outcome fairness on a protected attribute.

Answer

Use SageMaker Model Registry to gate the model on a fairness condition and configure EventBridge to notify the compliance team when the model version changes.

Answer

Attach a Clarify explainability job to the endpoint and configure a CloudWatch alarm on the endpoint's ModelLatency metric.

Answer

Create a SageMaker Model Monitor data quality job with a custom metric that flags predictions where the protected attribute equals a specific value, and alarm on that metric.

Question 8

A machine learning engineer is configuring a SageMaker Processing job that runs a custom container to compute bias metrics on a dataset containing personally identifiable information. The job reads input data from one S3 bucket and writes reports to another, and the security team requires that the container has no outbound internet access and that the input and output buckets are reached without traversing the public internet. Which configuration satisfies these requirements?

Accepted Answer

Set NetworkConfig.EnableNetworkIsolation to true, attach a VpcConfig with private subnets, and create S3 gateway VPC endpoints that the subnet route tables reference.. Network isolation removes the container's ability to make outbound calls, and the VPC configuration places processing instances in subnets you control. S3 gateway endpoints on those subnets' route tables provide a private path for reading inputs and writing reports, satisfying both the no-internet and no-public-traversal constraints without a NAT gateway.

Answer

Attach a VpcConfig with private subnets and a NAT gateway in the route table, and leave network isolation disabled so the container can reach S3.

Answer

Attach a VpcConfig with public subnets and an internet gateway, and set EnableNetworkIsolation to true so the container cannot use the gateway.

Answer

Set NetworkConfig.EnableNetworkIsolation to true and rely on the default SageMaker service-linked network path to reach S3.

Question 9

A fraud-detection team runs a SageMaker real-time endpoint in a production account. Their security team requires that the endpoint be reachable only from within a specific Amazon VPC and that access to invoke the endpoint be governed by identity-based policies with least privilege. Which TWO configurations should the ML engineer implement to meet these requirements? (Choose two.)

Accepted Answer

Attach an IAM policy to the calling role that allows sagemaker:InvokeEndpoint only for the specific endpoint ARN and denies other SageMaker actions.. Private connectivity through an interface VPC endpoint for SageMaker Runtime keeps invocation traffic inside the VPC and off the public internet, while an identity-based IAM policy scoped to the specific endpoint ARN enforces least-privilege authorization. Together they satisfy the network and identity requirements. Network isolation, volume encryption, and data capture address container egress, data-at-rest protection, and observability respectively.

Answer

Set the endpoint's DataCaptureConfig to capture 100 percent of requests and responses for monitoring.

Answer

Enable network isolation on the endpoint configuration to block all outbound traffic from the model container.

Answer

Configure the endpoint to use a customer-managed KMS key for volume encryption and rotate the key annually.

Question 10

A hospital's ML team deploys a diagnostic model to a SageMaker real-time endpoint. Compliance requires that every inference request and response be recorded for later auditing, and the records must be retrievable months later. The team needs a low-effort way to capture this data. Which approach should they use?

Accepted Answer

Enable data capture on the endpoint with a sampling percentage of 100 and an S3 destination, and apply an S3 lifecycle policy to retain the objects for the required period.. SageMaker data capture is the purpose-built feature for recording inference request and response payloads to Amazon S3, and a 100 percent sampling rate ensures every invocation is stored for audit. Pairing the capture destination with an S3 lifecycle policy retains records for the required period at low cost. Metrics, CloudTrail, and application-level logging do not capture full payloads as directly.

Answer

Turn on AWS CloudTrail data events for the endpoint and deliver them to an S3 bucket.

Answer

Enable Amazon CloudWatch metrics on the endpoint and export the metrics to Amazon S3 for archival.

Answer

Add application code that writes each request and response to Amazon CloudWatch Logs and set the log group retention to the audit period.

Question 11

A fraud-detection team runs a SageMaker real-time endpoint. Compliance requires that every inference request be logged with its full request and response payloads, and that a security engineer be able to prove later which requests were captured. The team enables SageMaker Model Monitor data capture with a capture percentage of 100. Where are the captured records stored, and what must be configured so the records are encrypted with a customer-managed key rather than an AWS-managed key?

Accepted Answer

Records are written to the S3 bucket specified in the DataCaptureConfig, and encryption with the customer-managed KMS key is applied by setting the KmsKeyId on that bucket's default encryption or by using an S3 bucket policy requiring the key.. Data capture stores request and response records as objects in the S3 bucket named in the endpoint's DataCaptureConfig, so key control is exercised at the S3 layer through default bucket encryption with a customer-managed KMS key or a bucket policy that denies uploads lacking that key. Endpoint volume keys and CloudWatch log groups do not govern those capture objects, making the S3-based approach the one that satisfies the audit and encryption requirement.

Answer

Records are written to the S3 bucket in the DataCaptureConfig, and the customer-managed key is passed as the VolumeKmsKeyId property on the endpoint configuration.

Answer

Records are written to Amazon CloudWatch Logs under the endpoint's log group, and the customer-managed key is supplied through the KmsKeyId parameter of the DataCaptureConfig object.

Answer

Records are written to an Amazon Kinesis Data Firehose delivery stream created automatically by SageMaker, and the customer-managed key is set on the Firehose stream's SSE configuration.

Question 12

A retail company uses a SageMaker Model Monitor data quality monitor on a real-time endpoint. The monitor's baseline was generated from a training dataset in which the "promo_code" feature was often null. In production the feature is now populated for nearly every record, and the monitor reports violations even though model accuracy has not degraded. The team wants the monitor to stop flagging this expected change without disabling monitoring entirely. What should they do?

Accepted Answer

Regenerate the baseline statistics and constraints from a recent, representative production dataset and update the monitoring schedule to use the new baseline.. Data quality monitors flag when observed statistics fall outside the constraints derived from the baseline. When a feature's production distribution legitimately diverges from training, the correct fix is to re-establish the baseline from representative recent data so constraints reflect the new normal, rather than muting or deleting the check.

Answer

Delete the monitoring schedule and create a new one with a longer monitoring interval so that fewer violations accumulate over time.

Answer

Edit the constraints JSON file in Amazon S3 to remove the promo_code entry, then leave the schedule unchanged.

Answer

Enable explainability monitoring on the schedule so that feature attribution drift accounts for the change in promo_code.

Question 13

A machine learning engineer is deploying a model to a SageMaker real-time endpoint that must be accessible only from within a specific Amazon VPC and must not have a public IP address. The engineer also needs to ensure that all data in transit between the endpoint and the calling application is encrypted. Which configuration should the engineer use?

Accepted Answer

Deploy the model to a SageMaker endpoint configured with a VPC configuration specifying private subnets and a security group, and invoke it through an interface VPC endpoint.. To make a SageMaker endpoint private and accessible only within a VPC, the endpoint must be deployed with a VPC configuration that specifies private subnets and security groups, which places its network interfaces in the VPC. Invoking it through an interface VPC endpoint (AWS PrivateLink) ensures traffic stays private and encrypted in transit.

Answer

Deploy the model to a SageMaker endpoint and attach an IAM resource policy that allows only principals from the VPC to invoke it.

Answer

Deploy the model to a SageMaker endpoint with network isolation enabled and use an interface VPC endpoint (AWS PrivateLink) for invocation.

Answer

Deploy the endpoint with a public IP and use an AWS WAF web ACL to restrict access to the VPC CIDR range.

Question 14

A healthcare analytics team stores model artifacts and training datasets in Amazon S3 and uses SageMaker. An internal audit finds that some S3 buckets containing protected health information are missing encryption and that access is granted broadly. The team must remediate quickly and prevent future misconfiguration. Which combination of actions should the ML engineer take FIRST?

Accepted Answer

Apply default bucket encryption with a customer-managed KMS key, enable S3 Block Public Access, and tighten bucket policies to least privilege.. Applying default SSE-KMS encryption with a customer-managed key secures new objects, while S3 Block Public Access and least-privilege bucket policies eliminate broad access. These actions directly fix the audit findings and set secure defaults to prevent recurrence. Logging, detection services, and bucket migration address visibility or workaround concerns rather than correcting the misconfiguration itself.

Answer

Enable S3 server access logging and CloudTrail data events, then review the logs to identify who accessed the unencrypted data.

Answer

Enable AWS Config rules to detect unencrypted buckets and use AWS Security Hub to aggregate findings for remediation.

Answer

Migrate all datasets and artifacts to a new bucket and delete the original buckets to eliminate the misconfiguration.

Question 15

A media company stores training data in an S3 bucket encrypted with an AWS KMS customer-managed key. A SageMaker training job runs inside a private VPC subnet with no internet access and must read that bucket. The job currently fails with an access-denied error from S3. Which change most directly resolves the failure while preserving the private-network requirement?

Accepted Answer

Add an interface VPC endpoint for S3 in the subnet and add the endpoint's condition to the bucket policy and KMS key policy so the endpoint can access both resources.. A training container in a subnet without internet access can only reach S3 through a VPC endpoint, and encrypted objects additionally require that the endpoint be authorized in both the S3 bucket policy and the KMS key policy. Supplying that endpoint plus the matching key and bucket policy conditions restores the data path while keeping all traffic inside the VPC and the data encrypted.

Answer

Enable SageMaker network isolation on the training job and grant the execution role kms:Decrypt on the customer-managed key.

Answer

Move the training data into an Amazon EFS file system mounted in the subnet and grant the execution role elasticfilesystem:ClientMount permissions.

Answer

Attach the AmazonS3FullAccess managed policy to the SageMaker execution role and disable the bucket's default encryption temporarily during training.