MLA-C01 Practice Test 48 — 15 Questions

Question 1

A company is using Amazon SageMaker to train a model on sensitive customer data. The security team requires that all data be encrypted in transit and at rest, and that the training job does not have internet access. Which configuration should the team use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the training job to run in a private subnet with no internet access, and use a KMS key for encryption. Running the SageMaker training job in a private subnet with no internet access ensures the job cannot reach the public internet, satisfying the no-internet-access requirement. Using an AWS KMS key for encryption at rest (for the S3 bucket and EBS volumes) and enforcing encryption in transit (via HTTPS/TLS for SageMaker and S3 endpoints) meets the encryption requirements. SageMaker training jobs in a private subnet use VPC endpoints (e.g., S3 and SageMaker API endpoints) to communicate securely without internet access.

Answer

Configure the training job to run in a public subnet with a security group that blocks outbound traffic

Answer

Configure the training job to run in a private subnet, but disable encryption to reduce latency

Answer

Configure the training job to run in a VPC with a NAT gateway, and use default SageMaker encryption

Question 2

A machine learning engineer wants to deploy a pre-trained foundation model for text summarization using SageMaker JumpStart. Which of the following is a primary cost consideration when deploying such a model?

Accepted Answer

The cost of GPU instances required for low-latency inference. Foundation models are large and require GPU instances, which are more expensive. Inference cost is driven by instance type (GPU vs CPU) and the number of instances. While throughput and latency are performance considerations, the primary cost factor is the compute instance type. Data transfer costs are secondary. Fine-tuning costs are separate.

Answer

The cost of fine-tuning the model on custom data

Answer

The cost of data transfer for inference requests

Answer

The cost of storing the model artifacts in S3

Question 3

Your team manages a SageMaker real-time endpoint for a financial services application that requires low latency for fraud detection. The model is a 1 GB XGBoost model. The endpoint is deployed on two ml.m5.xlarge instances with target tracking auto-scaling based on average CPU utilization at 70%. During peak hours, the endpoint receives a sudden burst of traffic that increases from 500 requests per second to 2000 requests per second within 30 seconds. Many requests start failing with 503 errors. The CPU utilization metric shows that the instances are at 90% before the scaling policy launches new instances. However, by the time the new instances are added (approximately 3 minutes), the burst has subsided. You need to prevent these failures during future bursts while keeping costs reasonable. Which action would be MOST effective?

Accepted Answer

Reduce the target tracking scaling metric to 45% CPU utilization and set a warm-up time of 120 seconds.. Reducing the target tracking scaling metric to 45% CPU utilization triggers scaling actions earlier, before the burst pushes CPU to 90%. Setting a warm-up time of 120 seconds ensures new instances are fully initialized and ready to serve traffic, preventing the 503 errors caused by the 3-minute lag in instance availability.

Answer

Change the scaling policy to step scaling with a lower cooldown (60 seconds) and add an alarm on invocation count.

Answer

Replace the two m5.xlarge instances with one m5.2xlarge instance and keep the same scaling policy.

Answer

Implement scheduled scaling to add two instances 5 minutes before the expected peak hour.

Question 4

An ML team uses AWS Step Functions to orchestrate a multi-step inference pipeline: data preprocessing, model inference, and postprocessing. The pipeline runs on demand for single records. The team notices that the pipeline occasionally fails due to timeouts in the preprocessing step. They want to implement retries with exponential backoff and a maximum retry count of 3 for that step. How should they configure this?

Accepted Answer

Modify the Step Functions state machine definition to add a Retry field on the preprocessing state with a maximum retry count of 3 and an exponential backoff rate of 2.0.. AWS Step Functions natively supports retry logic with exponential backoff directly in the state machine definition. By adding a `Retry` field on the preprocessing state with `MaxAttempts: 3` and `BackoffRate: 2.0`, the service automatically retries the step on specified errors (e.g., `States.Timeout` or `Lambda.ServiceException`) with exponentially increasing wait times, without requiring custom code or external orchestration.

Answer

Implement retry logic inside the preprocessing Lambda function code.

Answer

Wrap the preprocessing step in a SageMaker Pipeline step with retry policy.

Answer

Add a Catch in the state machine to rerun the entire pipeline if preprocessing fails.

Question 5

A company wants to restrict access to a SageMaker notebook instance so that only a specific IAM role can open the notebook via JupyterLab. The notebook instance is associated with a lifecycle configuration that installs custom packages. What is the correct way to enforce access control?

Accepted Answer

Grant the specific IAM role permission to call sagemaker:CreatePresignedNotebookInstanceUrl on that notebook instance.. The `sagemaker:CreatePresignedNotebookInstanceUrl` API action generates a URL that provides authenticated access to the notebook instance's JupyterLab interface. By granting this permission only to the specific IAM role, you ensure that only that role can call the API and obtain the presigned URL, effectively restricting access to the notebook. This is the native, recommended way to control access to a SageMaker notebook instance without relying on network-level controls or SSH proxies.

Answer

Set the notebook instance's Direct Internet Access to disabled and use IAM authentication.

Answer

Use AWS Systems Manager to proxy SSH access, then use IAM permission.

Answer

Configure the notebook instance to use a VPC and restrict access via security groups.

Question 6

A data engineer is building a feature store using Amazon SageMaker Feature Store. The team needs to store features that are updated frequently and require low-latency retrieval for real-time inference. Which type of store should the engineer use?

Accepted Answer

Online store. Online store provides low-latency access for real-time inference. Offline store is for batch analytics.

Answer

Both online and offline store

Answer

Offline store

Answer

Amazon DynamoDB directly

Question 7

A data scientist is preparing a dataset for a multiclass classification problem. The dataset has a categorical feature with 50 unique values (medium cardinality) and a target variable with 5 classes. The scientist wants to encode the categorical feature in a way that captures the relationship with the target while keeping the number of output features manageable. Which TWO encoding methods should the scientist consider? (Select TWO.)

Accepted Answer

Target encoding. Target encoding captures the target relationship and produces a single numeric column. Ordinal encoding assigns integers but may imply order. One-hot encoding creates 50 columns, which may be acceptable but increases dimensionality. Frequency encoding loses target signal. The best choices are target encoding (directly uses target) and one-hot encoding (if dimensionality is acceptable).

Answer

Frequency encoding

Answer

Label encoding

Answer

Ordinal encoding

Question 8

A team wants to ensure that their SageMaker training jobs cannot access the internet for security reasons. However, they need to download a public PyTorch package for training. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Configure the training job to run in VPC-only mode. Enabling VPC-only mode (also known as network isolation) for a SageMaker training job ensures the job runs within a specified VPC and cannot access the internet. This satisfies the security requirement of blocking internet access. Option E is correct because creating an S3 VPC interface endpoint allows the training job to download the public PyTorch package from S3 privately, using AWS PrivateLink, without traversing the internet.

Answer

Use a public subnet for the training job

Answer

Disable network isolation for the training job

Answer

Attach a NAT Gateway to the VPC to allow outbound internet

Question 9

A company is using Amazon SageMaker Ground Truth to create a labeled dataset for object detection in images. The team wants to minimize labeling costs while maintaining high accuracy. Which feature should they use to achieve this?

Accepted Answer

Enable automated data labeling with active learning. Active learning in Ground Truth automatically selects the most uncertain or informative samples from the unlabeled pool and sends them to human labelers, reducing the total number of images that need manual labeling.

Answer

Use a private workforce of internal employees

Answer

Use a larger initial training set with pre-labeled public datasets

Answer

Reduce the number of label categories

Question 10

A company uses SageMaker Ground Truth to create a labeled dataset, then trains a model using SageMaker Training. They want to automate the pipeline so that whenever a labeling job is completed, it triggers the training job. Which architecture meets this requirement with minimal latency?

Accepted Answer

Use Amazon CloudWatch Events (EventBridge) to detect the completed labeling job and trigger a SageMaker Pipeline execution.. Amazon EventBridge can natively capture SageMaker job state changes (e.g., `SageMaker Labeling Job State Change` to `Completed`) and directly trigger a SageMaker Pipeline execution. This event-driven approach eliminates polling overhead and provides the lowest latency by reacting immediately when the labeling job finishes.

Answer

Use AWS Step Functions to poll the labeling job status and then start training.

Answer

Configure an S3 event notification on the labeling job output bucket to trigger a Lambda function that starts training.

Answer

Set up a scheduled cron job in EventBridge to check for completed labeling jobs every hour and start training if found.

Question 11

An engineer runs: aws sagemaker describe-endpoint --endpoint-name my-endpoint and receives the exhibit output. The engineer wants to update the endpoint to use a new model version stored in ECR with tag ':2'. Which step is necessary to perform the update?

Accepted Answer

Create a new endpoint configuration (my-endpoint-config-v2) referencing the new image, then call update-endpoint with the new config name.. SageMaker endpoints are immutable with respect to their configuration; you cannot modify an existing endpoint configuration in place. To update an endpoint to use a new model version, you must create a new endpoint configuration (e.g., my-endpoint-config-v2) that points to the new ECR image tag ':2', then call update-endpoint with the new configuration name. This triggers a zero-downtime deployment where SageMaker gradually shifts traffic to the new variant.

Answer

Modify the existing endpoint configuration (my-endpoint-config-v1) to use the new image, then update the endpoint.

Answer

Use the update-endpoint command directly with the new image ARN.

Answer

Delete the endpoint and recreate it with the new model image.

Question 12

A healthcare company deploys a model to predict patient readmission risk. The model was trained on historical data and is now showing signs of concept drift. The team needs to implement a monitoring solution that can detect drift and automatically retrain the model when drift is detected. Which THREE steps should the team take to build this solution? (Choose THREE.)

Accepted Answer

Deploy SageMaker Model Monitor to track prediction quality over time. A is correct because Amazon SageMaker Model Monitor can continuously track prediction quality metrics (e.g., accuracy, precision) over time by analyzing data captured from the endpoint. This allows the team to detect concept drift by comparing live predictions against a baseline, triggering alerts when performance degrades. It provides a managed, automated way to monitor model quality without manual intervention.

Answer

Disable the existing endpoint to prevent stale predictions during retraining

Answer

Manually compare the model's predictions against a holdout validation set each week

Question 13

A data science team wants to deploy a real-time inference endpoint on Amazon SageMaker for a model that requires low latency (under 100 ms). The model is a small ensemble of three tree-based models, each about 50 MB. The team expects around 1000 requests per minute, with occasional spikes to 5000 requests per minute. Which instance type and deployment strategy would be MOST cost-effective while meeting the latency requirement?

Accepted Answer

Deploy a single model endpoint on an ml.c5.large instance with Auto Scaling configured using a target tracking policy based on invocations per minute. Deploying a single model endpoint on an ml.c5.large instance with Auto Scaling based on invocations per minute provides the necessary compute capacity for the expected 1000 requests per minute while scaling up to handle spikes up to 5000 requests per minute. The ml.c5.large instance offers sufficient memory (4 GB) and compute for three 50 MB tree-based models, and the target tracking policy ensures low latency by maintaining a buffer of capacity without over-provisioning, keeping inference under 100 ms.

Answer

Deploy a single model endpoint on an ml.c5.large instance with a Multi-Model endpoint

Answer

Use SageMaker batch transform with multiple ml.c5.large instances to process all requests offline

Answer

Deploy a single model endpoint on an ml.c5.xlarge instance with provisioned concurrency

Question 14

A data science team is deploying a model on Amazon SageMaker and wants to protect the endpoint from unauthorized access. Which TWO methods can the team use to secure the endpoint? (Choose TWO.)

Accepted Answer

Configure the endpoint to be deployed within a VPC and control traffic using security groups and network ACLs.. Deploying a SageMaker endpoint within a VPC allows you to control inbound and outbound traffic using security groups and network ACLs, effectively restricting network-level access to the endpoint. This is a fundamental network security measure that prevents unauthorized network traffic from reaching the endpoint.

Answer

Use a resource-based IAM policy on the endpoint to restrict invocation.

Answer

Place an Amazon API Gateway in front of the endpoint with AWS WAF.

Answer

Attach a security group directly to the SageMaker endpoint.

Question 15

A machine learning engineer is using SageMaker Data Wrangler to perform data validation. Which step should be added to the pipeline to ensure data quality before training?

Accepted Answer

Apply a 'Data Quality' transformation in Data Wrangler to validate column statistics. SageMaker Data Wrangler includes a built-in 'Data Quality' transformation that allows you to validate column statistics (e.g., missing values, min/max, distinct counts) directly within the visual pipeline. This step ensures data quality without requiring custom code or external services, integrating seamlessly with the Data Wrangler workflow for pre-training validation.

Answer

Write a custom SageMaker Processing job for validation

Answer

Use AWS Glue DataBrew to profile the dataset

Answer

Add a SageMaker Pipeline step to check data quality after Data Wrangler