MLA-C01 ML Solution Monitoring, Maintenance, and Security Practice Test 3 — 15 Questions

Question 1

A financial services company needs to deploy a SageMaker endpoint that processes sensitive customer data. The security policy requires that all data in transit between the endpoint and the application must be encrypted, and that the endpoint cannot be accessed from the public internet. Additionally, model containers must not be able to initiate outbound internet requests. Which combination of settings meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC-only mode for the endpoint and set EnableInterContainerTrafficEncryption to True. Enabling VPC-only mode for the SageMaker endpoint ensures the endpoint is not accessible from the public internet, and setting EnableInterContainerTrafficEncryption to True encrypts data in transit between containers within the endpoint. This combination directly satisfies the requirements for no public internet access and encrypted data in transit, while the model containers are isolated from outbound internet requests by the VPC configuration.

Answer

Attach a public endpoint with an SSL certificate and restrict access via IAM

Answer

Use a private subnet with a NAT Gateway and set EnableNetworkIsolation to True

Answer

Deploy on a multi-model endpoint with encryption at rest using KMS

Question 2

A company deploys a real-time inference endpoint and wants to be alerted if the number of 4XX errors exceeds 10 per minute over a 5-minute period. Which steps should they take?

Accepted Answer

Create a CloudWatch alarm on the 4XXError metric with a threshold of 10 and an evaluation period of 5 minutes, and configure SNS notification. A CloudWatch alarm on the `4XXError` metric with a threshold of 10 and an evaluation period of 5 minutes directly monitors the rate of HTTP 4XX errors from the SageMaker real-time inference endpoint. When the alarm state transitions to ALARM (i.e., the average 4XX errors per minute exceeds 10 over the 5-minute window), it triggers an SNS notification to alert the team. This is the standard approach for real-time metric-based alerting in AWS.

Answer

Create a CloudWatch alarm on the Invocations metric and set a threshold

Answer

Enable endpoint auto-scaling with a target tracking policy

Answer

Use SageMaker Model Monitor to capture invocations and trigger an SNS topic

Question 3

A team is using SageMaker Clarify to detect bias drift in a deployed model's predictions. They run weekly bias monitoring jobs. The team wants to be notified when the bias metric for a sensitive feature exceeds a threshold. What is the most efficient method to achieve this?

Accepted Answer

After each Clarify job, run a custom Lambda that parses the report and publishes a custom CloudWatch metric; create an alarm on that metric. SageMaker Clarify bias monitoring jobs output a JSON report to S3 but do not natively publish CloudWatch metrics. By using a custom Lambda to parse the report and publish a custom CloudWatch metric, you can then create a CloudWatch alarm that triggers notifications when the bias metric exceeds a threshold. This is the most efficient automated method because it leverages CloudWatch's native alarm and notification capabilities without manual intervention.

Answer

Configure the Clarify monitoring job to send results to an SNS topic directly

Answer

Manually review the bias report in SageMaker Studio each week

Answer

Use SageMaker Model Monitor - Bias Drift Monitor which automatically creates CloudWatch metrics

Question 4

A machine learning engineer is deploying a model using a SageMaker endpoint and needs to ensure that the model artifacts are encrypted at rest using a customer-managed KMS key. Which configuration should they set?

Accepted Answer

Set the KMS key when creating the model using the CreateModel API. The `CreateModel` API in SageMaker accepts a `ModelKmsKeyId` parameter that specifies a customer-managed KMS key for encrypting the model artifacts at rest. This key is used when SageMaker copies the artifacts from S3 to the inference instance's Amazon EBS volume, ensuring encryption at rest. The other options either apply to different resources or do not control the encryption of the model artifacts themselves.

Answer

Set the KMS key in the endpoint configuration's ProductionVariant

Answer

Enable default encryption on the S3 bucket containing the model artifacts

Answer

Use SageMaker Studio's KMS integration

Question 5

A company wants to share a trained model across multiple AWS accounts for inference. The model is stored in a central account's S3 bucket and needs to be deployed in other accounts' SageMaker endpoints. What is the recommended approach?

Accepted Answer

Attach a resource policy to the model in the central account allowing the other accounts' SageMaker service principals to access it. SageMaker allows you to attach a resource-based policy directly to the model resource in the central account, granting the SageMaker service principal from other accounts permission to call `sagemaker:CreateModel` and `sagemaker:CreateEndpointConfig` using the shared model. This approach avoids copying artifacts and leverages AWS Identity and Access Management (IAM) cross-account trust, where the central account's model policy explicitly allows the remote account's SageMaker service role to access the model and its underlying S3 objects.

Answer

Use AWS RAM to share the model artifact S3 bucket

Answer

Use SageMaker Model Registry with cross-account sharing enabled

Answer

Copy the model artifacts to each account's S3 bucket and create separate models

Question 6

A team wants to ensure that their SageMaker training jobs cannot access the internet for security reasons. However, they need to download a public PyTorch package for training. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Configure the training job to run in VPC-only mode. Option A is correct because setting the SageMaker training job to run in VPC-only mode (EnableNetworkIsolation=true) removes all inbound and outbound internet access, which is exactly the security posture the team wants. Option E is correct because, with network isolation enabled, the job cannot reach the public internet, so an S3 VPC interface endpoint (AWS PrivateLink) is needed to let the job pull training data and write model artifacts to S3 privately over the AWS network. Option B is wrong because a public subnet would still expose the job to internet routing and contradicts the goal of no internet access. Option C is wrong because disabling network isolation would re-enable internet access, the opposite of what is required. Option D is wrong because attaching a NAT Gateway would explicitly allow outbound internet traffic, which the team wants to prevent.

Answer

Use a public subnet for the training job

Answer

Disable network isolation for the training job

Answer

Attach a NAT Gateway to the VPC to allow outbound internet

Question 7

A financial services company must deploy a SageMaker endpoint that only accepts traffic from within a VPC and encrypts all data at rest and in transit using customer-managed KMS keys. They also need to prevent inter-container traffic from being visible to other users. Which combination of settings fulfills these requirements?

Accepted Answer

Configure the endpoint with VPC-only mode, enable inter-container traffic encryption, and specify a KMS key for endpoint data encryption. VPC-only mode ensures the endpoint is reachable only from within the specified VPC, inter-container traffic encryption protects traffic between containers on the same instance from being visible to other users, and specifying a KMS key enables encryption at rest with a customer-managed key. Together these three settings satisfy the VPC-only, encryption-in-transit, encryption-at-rest, and inter-container isolation requirements in one configuration.

Answer

Deploy the endpoint in a private subnet and use SageMaker Model Monitor to detect unauthorized access

Answer

Attach a security group that only allows inbound traffic from the VPC CIDR and enable data encryption using a KMS key

Answer

Enable network isolation mode and use a VPC configuration with no public internet access

Question 8

A data science team wants to automate the retraining of a model whenever SageMaker Model Monitor detects a significant drift in data quality. They need the least amount of custom code. Which approach should they use?

Accepted Answer

Set up a CloudWatch Alarm on the Model Monitor violation metric that sends a notification to an SNS topic, which triggers an AWS Lambda function to start a SageMaker pipeline. CloudWatch Alarms can be set on Model Monitor violation metrics. The alarm triggers an SNS topic that invokes a Lambda function to start a retraining pipeline. This requires minimal custom code.

Answer

Write a custom script on an EC2 instance that polls the Model Monitor endpoint every hour and triggers retraining if drift is detected

Answer

Configure an Amazon EventBridge rule that listens for Model Monitor violation events and directly triggers a SageMaker Pipeline execution

Answer

Use SageMaker Autopilot to automatically retrain the model when performance degrades

Question 9

A machine learning engineer wants to reduce costs for a SageMaker real-time endpoint that experiences predictable traffic patterns with low traffic at night and high traffic during business hours. Which approach is most cost-effective while maintaining availability?

Accepted Answer

Configure an auto-scaling policy with target tracking based on the Invocations metric. SageMaker real-time endpoints support Application Auto Scaling with target-tracking policies. Using the Invocations metric (or a custom metric like InvocationsPerInstance) as the target allows the endpoint to scale instance count up during business hours and down at night automatically, matching capacity to the predictable traffic pattern while maintaining availability and minimizing cost.

Answer

Use a single large instance type that can handle peak traffic at all times

Answer

Set up a scheduled scaling policy that manually adjusts instances at fixed times

Answer

Use SageMaker Inference Recommender to find the optimal instance type and then manually set instance count

Question 10

A company needs to ensure that their SageMaker Studio environment is only accessible from within their corporate network and that all data processed in Studio remains encrypted. Which configuration should they use?

Accepted Answer

Enable SageMaker Studio in VPC-only mode and use a KMS key for data encryption. Enabling SageMaker Studio in VPC-only mode ensures that the Studio environment is accessible only from within the corporate network by routing all traffic through a VPC with no public internet access. Additionally, using a KMS key for data encryption provides customer-managed encryption for data at rest and in transit within the Studio environment, meeting the encryption requirement.

Answer

Use SageMaker Studio with public internet access and enable AWS WAF

Answer

Place SageMaker Studio in a public subnet and use security groups to restrict access

Answer

Use IAM policies to allow only corporate IP addresses and enable encryption at rest with an S3 bucket key

Question 11

A company wants to allow a SageMaker model in one AWS account to be accessed by a different AWS account for inference. They need to maintain security and compliance. Which approach meets the requirement?

Accepted Answer

Attach a resource-based policy to the SageMaker endpoint that grants the other account's IAM role invoke permissions. SageMaker endpoints support resource-based policies that can grant cross-account principals (such as another account's IAM role) permission to invoke the endpoint. Attaching such a policy to the endpoint is the native, least-privilege way to share inference access across accounts while keeping the model, artifacts, and endpoint in the owning account. The calling account's role then needs only sts:AssumeRole or direct invoke permissions as granted by the policy.

Answer

Use AWS PrivateLink to expose the SageMaker endpoint privately and grant access via security groups

Answer

Create an IAM role in the source account and share the role ARN with the target account

Answer

Share the model artifacts via an S3 bucket with cross-account bucket policies and let the other account deploy independently

Question 12

A company is deploying a SageMaker endpoint and must meet strict security requirements: no public internet access, all inter-container traffic must be encrypted, and all data at rest must be encrypted with a customer-managed KMS key. Which THREE configurations should they apply? (Choose THREE.)

Accepted Answer

Configure the endpoint to use VPC-only mode

Answer

Attach a security group that only allows inbound traffic from the VPC CIDR

Answer

Enable network isolation mode on the endpoint

Question 13

A machine learning engineer needs to automatically retrain a model whenever SageMaker Model Monitor detects data drift. Which combination of services should be used to trigger the retraining pipeline?

Accepted Answer

CloudWatch Alarms → SNS → Lambda → SageMaker Processing job. SageMaker Model Monitor publishes metrics to CloudWatch, and when data drift is detected, a CloudWatch Alarm triggers an SNS notification, which invokes a Lambda function to start a SageMaker Processing job for retraining. This architecture decouples monitoring from retraining and uses native AWS services for event-driven automation.

Answer

SageMaker Ground Truth → Lambda → SageMaker Training job

Answer

SageMaker Model Monitor → EventBridge → Step Functions → SageMaker Training job

Answer

SageMaker Data Wrangler → SNS → SageMaker Training job

Question 14

A company has deployed a real-time inference endpoint using SageMaker. The endpoint latency is within acceptable limits, but the team notices that the Invocations metric shows occasional spikes. They want to investigate the source of the spikes. Which CloudWatch metric should they examine to isolate the time spent in SageMaker overhead versus model inference?

Accepted Answer

Both ModelLatency and OverheadLatency

Answer

OverheadLatency

Answer

Latency

Answer

ModelLatency

Question 15

A machine learning team is using SageMaker Studio for model development. They need to restrict all internet access from Studio notebooks and ensure that all data stays within a VPC. Which configuration should they use?

Accepted Answer

Configure the Studio domain with VPC-only mode and disable direct internet access. Configuring a SageMaker Studio domain with VPC-only mode and disabling direct internet access ensures that all Studio notebook traffic stays within the VPC and has no route to the public internet. This is the only configuration that both restricts internet access and enforces data residency within the VPC by using VPC-only networking, which does not rely on an internet gateway or NAT gateway for outbound traffic.

Answer

Use a private link to connect Studio to the VPC

Answer

Enable network isolation mode for the Studio domain

Answer

Attach a security group that blocks all outbound traffic