MLA-C01 ML Solution Monitoring, Maintenance, and Security Practice Test 4 — 15 Questions

Question 1

A company wants to implement cost monitoring and optimization for SageMaker endpoints. Which TWO actions should they take? (Select TWO)

Accepted Answer

Use SageMaker Savings Plans to get discounted rates in exchange for a commitment. SageMaker Savings Plans offer discounted compute rates (up to 64% off on-demand) in exchange for a 1- or 3-year commitment to a consistent amount of compute usage (measured in dollars per hour), directly reducing endpoint costs. This is a cost optimization mechanism, not a monitoring one, and aligns with the goal of reducing spend on SageMaker endpoints.

Answer

Manually scale instances based on historical patterns

Answer

Enable detailed billing reports to track endpoint costs

Answer

Use SageMaker Model Monitor to reduce endpoint costs

Question 2

A company uses SageMaker Model Monitor to detect data drift in production. The monitoring job compares the current data distribution to a baseline. Which TWO types of drift can SageMaker Model Monitor detect? (Select TWO)

Accepted Answer

Data quality drift (schema and statistical drift). SageMaker Model Monitor can detect data quality drift (option B), which covers schema drift (e.g., unexpected data types, missing or extra columns) and statistical drift (e.g., changes in distributions of individual features compared to the baseline statistics). It can also detect model quality drift (option C), which measures degradation in model performance metrics such as accuracy, precision, or RMSE by comparing predictions against ground truth labels collected via Model Monitor's ground truth ingestion. These two monitoring types are directly supported by the DataQualityMonitor and ModelQualityMonitor capabilities in SageMaker. Concept drift (option A) is not a distinct monitor type offered by Model Monitor; it is a broader ML concept not directly measured by the service. Bias drift (option D) is handled by SageMaker Clarify's bias detection, not Model Monitor's drift jobs. Feature attribution drift (option E) is detected by SageMaker Clarify's explainability monitoring, not by Model Monitor's core drift detection types.

Answer

Concept drift (change in the relationship between features and target)

Answer

Bias drift (change in bias metrics over time)

Answer

Feature attribution drift (SHAP values)

Question 3

A fraud detection team runs a SageMaker real-time endpoint that serves a model trained with the built-in XGBoost algorithm. Compliance requires that every inference request be attributable to a specific user, and that the team be able to prove after the fact which model artifact version produced each prediction. The endpoint is invoked only by an internal application using the AWS SDK. Which combination of actions should the machine learning engineer take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Create the model from a SageMaker Model Registry model package and deploy it to the endpoint, then enable data capture on the endpoint to log request and response data to Amazon S3, and use the IAM role and model package version recorded in the registry for attribution.. The requirement has two parts: attributing a prediction to a user and proving which model artifact produced it. Model Registry provides immutable model package versions that can be traced to the endpoint, while data capture records the request and response payloads for later audit. Together they give an auditable chain without custom application logic, keeping operational overhead low.

Answer

Deploy the model with a model package registered in SageMaker Model Registry, and add custom metadata to each InvokeEndpoint call so the caller passes the user identity and the model version in the request body.

Answer

Configure the endpoint to log to Amazon CloudWatch Logs, and enable AWS CloudTrail data events for the sagemaker-runtime InvokeEndpoint API, then correlate the CloudTrail identity with the CloudWatch inference logs by timestamp.

Answer

Enable SageMaker Model Monitor data capture on the endpoint with a sampling percentage of 100, and store the captured data in Amazon S3; rely on the S3 object timestamps to correlate requests with users.

Question 4

A financial services company runs a SageMaker real-time endpoint that serves loan-default predictions. Security policy requires that all inference requests and responses be encrypted in transit using a customer-managed AWS KMS key, and the team wants to be able to audit which key was used. The endpoint currently uses an AWS-owned key for volume encryption. Which action should the ML engineer take to meet the requirement?

Accepted Answer

Configure the endpoint with a customer-managed KMS key for volume encryption and invoke it over HTTPS using the SageMaker runtime endpoint URL.. Real-time endpoints encrypt invocation traffic with TLS when called over HTTPS, and the endpoint configuration's KmsKeyId parameter applies a customer-managed key to the attached storage volume. Combining a customer-managed key on the endpoint with HTTPS invocation satisfies both the encryption and auditability requirements. Network isolation, VPC endpoints, and data capture settings address different concerns.

Answer

Enable the endpoint's network isolation setting and attach a KMS key policy to the endpoint configuration.

Answer

Attach an interface VPC endpoint for SageMaker Runtime and set the endpoint to use a customer-managed KMS key for the model artifacts.

Answer

Set the endpoint's DataCaptureConfig to use a customer-managed KMS key and enable encryption on the S3 bucket that stores the captured data.

Question 5

A media company deploys a SageMaker endpoint that classifies user-generated content. Compliance requires that the model's predictions be explainable for any individual request, and that explanations be captured for later review without slowing down the primary inference path. The team already logs inputs and outputs with Data Capture. Which additional configuration should the ML engineer apply?

Accepted Answer

Enable SageMaker Clarify explainability on the endpoint with a SHAP baseline and capture the analysis results through the endpoint's data capture.. Clarify explainability integrates with a real-time endpoint by analyzing captured request data asynchronously and writing SHAP-based feature attributions to Amazon S3. Because the analysis runs out-of-band from the InvokeEndpoint call, primary inference latency is unaffected, and the explanations are persisted for audit. Model Monitor, raw weight output, and Debugger do not deliver per-request SHAP explanations.

Answer

Enable SageMaker Debugger on the endpoint to capture tensor values during inference and store them in Amazon S3.

Answer

Configure the endpoint to return the model's internal feature weights in the response payload for every invocation.

Answer

Attach a SageMaker Model Monitor data quality baseline to the endpoint and configure hourly monitoring schedules.

Question 6

A machine learning engineer has deployed a real-time SageMaker endpoint that serves loan-default predictions. Compliance requires that every invocation be attributable to a specific IAM principal and that no request bodies be stored in CloudWatch. The engineer already enabled data capture on the endpoint. Which configuration change should the engineer make to satisfy these requirements?

Accepted Answer

Disable data capture on the endpoint and turn on CloudTrail logging of the InvokeEndpoint API call so each invocation records the calling IAM principal.. The requirement has two parts: no request bodies stored in CloudWatch, and each invocation attributable to an IAM principal. Turning off data capture removes payload persistence entirely, while CloudTrail's InvokeEndpoint records provide the authenticated caller identity for every call. Together they satisfy both constraints without relying on client-supplied headers or on capture modes that SageMaker does not actually provide.

Answer

Disable data capture on the endpoint and enable CloudWatch Logs with a metric filter that records only the caller identity from the request header.

Answer

Set the data capture destination to an S3 bucket that has default encryption with an AWS KMS customer managed key and enable CloudTrail data events on that bucket.

Answer

Keep data capture enabled for EndpointInput but set the capture mode so that only sampling percentages and the endpoint ARN are recorded, and rely on CloudTrail management events for attribution.

Question 7

A machine learning engineer has scheduled a SageMaker Model Monitor data quality monitoring job for a production endpoint. The monitoring schedule runs hourly, and each execution writes statistics and constraint violations to Amazon S3. Compliance requires that the engineer be alerted within minutes when the number of violations in a single execution exceeds a defined threshold, without polling the S3 output manually. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Configure the monitoring schedule with a CloudWatch alarm on the Model Monitor violation metrics, and notify an Amazon SNS topic from the alarm action.. Model Monitor emits monitoring execution metrics, including violation counts, into Amazon CloudWatch. Alarming on those metrics and routing the alarm action to Amazon SNS provides threshold-based, near-real-time notification with no custom polling code. The other approaches either recreate an existing signal with extra moving parts or depend on a notification feature that the service does not provide.

Answer

Write an AWS Lambda function that lists the S3 monitoring output prefix every five minutes and publishes to Amazon SNS when new violations appear.

Answer

Enable SageMaker Model Monitor's built-in email notification setting on the monitoring schedule so violations are emailed to the engineer.

Answer

Create an Amazon EventBridge rule that matches the SageMaker Model Monitor execution state change and invokes an AWS Lambda function to send notifications.

Question 8

A financial services company runs a SageMaker real-time endpoint that scores loan applications. Compliance requires that every inference request and response be captured for seven years and that no payload ever traverse the public internet. The team enables SageMaker Data Capture on the endpoint and must choose a destination. Which configuration meets these requirements?

Accepted Answer

Configure Data Capture to write to an Amazon S3 bucket using an S3 endpoint (AWS PrivateLink) and set the capture destination to that bucket with a lifecycle policy retaining objects for 2555 days.. Data Capture stores request and response payloads as objects in Amazon S3, so the retention control belongs in S3 lifecycle rules, and the private-network control belongs in an S3 interface endpoint (AWS PrivateLink). Combining those two gives a capture path that never leaves the AWS network and keeps records for the full seven-year window.

Answer

Configure Data Capture to write to an Amazon S3 bucket and enable server-side encryption with AWS KMS, relying on encryption to prevent payloads from being readable in transit.

Answer

Configure Data Capture to write to an Amazon S3 bucket and restrict access with a bucket policy that denies requests whose source IP is outside the corporate CIDR range.

Answer

Configure Data Capture to publish records to an Amazon Kinesis Data Firehose delivery stream that writes to Amazon OpenSearch Service for long-term retention.

Question 9

A team operates a SageMaker real-time endpoint behind an Application Load Balancer. Security policy requires that all traffic from clients to the endpoint be encrypted in transit and that the endpoint accept connections only from within the VPC. The endpoint currently has no network isolation and uses a public DNS name. Which change should the machine learning engineer make?

Accepted Answer

Create an interface VPC endpoint for the SageMaker runtime, configure the endpoint with VPC configuration in private subnets, and require TLS on the ALB listener that forwards to it.. The two requirements map to two distinct controls. Private subnets with a security group plus an interface VPC endpoint for the SageMaker runtime keep all invocation traffic inside the VPC via AWS PrivateLink, eliminating public exposure. Enforcing TLS on the ALB listener that forwards to the endpoint ensures client-to-endpoint traffic is encrypted in transit. Together these satisfy VPC-only access and transport encryption.

Answer

Move the endpoint to a public subnet and attach an AWS WAF web ACL to the ALB to filter traffic, then enable encryption at rest with a customer managed key.

Answer

Enable network isolation on the model and attach a VPC configuration with private subnets so the container cannot make outbound calls.

Answer

Configure the endpoint with a VPC configuration using private subnets and a security group, and set the endpoint's KmsKeyId to a customer managed key.

Question 10

A security team must ensure that all data at rest produced by a SageMaker training job, including model artifacts, inter-container traffic encryption keys, and the output of a SageMaker Debugger rule, is encrypted with a customer managed AWS KMS key rather than an AWS managed key. The training job uses the SageMaker Python SDK with a KMS key already specified for the output volume. Which additional configuration is required to satisfy this requirement?

Accepted Answer

Specify the customer managed KMS key in the OutputDataConfig KmsKeyId and in the VolumeKmsKeyId, and pass the same key to the Debugger rule configuration so rule output is encrypted.. SageMaker training encrypts distinct artifact classes through distinct parameters. Model artifacts and training output follow OutputDataConfig.KmsKeyId, the attached storage volume follows VolumeKmsKeyId, and Debugger rule output has its own key setting. Meeting a customer managed key mandate means populating each parameter with that key and granting the execution role KMS permissions, not assuming one setting propagates.

Answer

Attach an IAM policy to the training job's execution role granting kms:Encrypt and kms:GenerateDataKey on the customer managed key, and SageMaker will then apply that key to all outputs automatically.

Answer

Set the KmsKeyId on the SageMaker training job's ResourceConfig and set the S3 bucket default encryption to the customer managed key.

Answer

Enable the EnableNetworkIsolation parameter on the training job and rely on the account-level default KMS key for all artifacts.

Question 11

A media company deploys a SageMaker real-time endpoint backed by a model trained on licensed content metadata. Legal requires that the model artifacts and the training dataset be encrypted with a customer managed AWS KMS key, and that the endpoint cannot be invoked by principals outside the analytics AWS account. The team already stores data in Amazon S3. Which combination of steps enforces these requirements with the least operational overhead?

Accepted Answer

Use an AWS KMS customer managed key for the S3 bucket, the SageMaker training job output, and the endpoint configuration volume, and attach a resource-based policy to the endpoint that allows invocation only from the analytics account.. Encryption at rest for SageMaker workloads is applied through KMS keys specified on the training job, model, and endpoint configuration, plus SSE-KMS on the S3 dataset. Invocation isolation between accounts is enforced with an endpoint resource-based policy that names the permitted account, giving both controls with minimal added infrastructure.

Answer

Enable default encryption on the S3 bucket with an AWS managed key and configure the endpoint to use AWS PrivateLink, then rely on VPC endpoints to restrict invocation.

Answer

Use an AWS KMS customer managed key for the S3 bucket and training output, and place the endpoint behind an Application Load Balancer with a security group that only permits the analytics account's VPC CIDR.

Answer

Use an AWS KMS customer managed key for the S3 bucket and training output, and create an IAM permissions boundary on the endpoint's execution role that denies cross-account invocation.

Question 12

A machine learning engineer is using SageMaker Model Monitor to detect bias in a deployed model that makes loan approval decisions. The engineer has created a baseline with bias metrics and configured a monitoring schedule. After several weeks, the engineer notices that the bias metrics are not being computed for some monitoring executions, and the reports show missing data. What is the MOST likely cause?

Accepted Answer

The endpoint's data capture is configured to sample only a percentage of requests, resulting in insufficient data for bias metric computation.. Bias monitoring in Model Monitor depends on having enough captured inference data that includes both the model's predictions and the ground truth labels, along with the sensitive attribute. If data capture samples only a small percentage of requests, the resulting dataset may be too sparse for the bias metrics to be computed reliably, causing missing data in some monitoring executions.

Answer

The IAM role used by the monitoring schedule lacks permission to read from the S3 bucket where ground truth data is stored.

Answer

The baseline constraints file does not include the sensitive attribute, so Model Monitor cannot compute bias metrics.

Answer

The monitoring schedule is using a monitoring type of ModelQuality instead of BiasDrift.

Question 13

A retail bank has a SageMaker real-time endpoint serving a credit-risk model. Auditors require that no inference request or response payload can be read from the hosting infrastructure by an operator with instance-level access, and that all traffic between clients and the endpoint stays on the AWS private network. Which TWO configurations should the machine learning engineer apply? (Choose two.)

Accepted Answer

Deploy the endpoint with a VPC configuration and enable AWS KMS encryption on the attached storage volume used by the hosting instances.. Encrypting the endpoint's attached storage volume with a customer-managed KMS key protects payload residues at the infrastructure layer, while deploying into private subnets and invoking through a VPC interface endpoint keeps all client traffic on the AWS private network. Together these two controls directly answer the auditors' requirements about instance-level readability and non-public network paths.

Answer

Attach the AmazonSageMakerFullAccess policy to the endpoint's execution role and rotate the role credentials every 24 hours.

Answer

Configure the endpoint with EnableNetworkIsolation set to true on the model container definition.

Answer

Disable data capture on the endpoint so that request and response payloads are never written to Amazon S3.

Question 14

A financial services company runs a SageMaker real-time endpoint that processes sensitive customer transaction features. Auditors require that all inference requests and responses are encrypted in transit, that the endpoint accepts traffic only from applications inside a specific Amazon VPC, and that no traffic traverses the public internet. Which TWO configurations should the machine learning engineer implement to meet these requirements? (Choose two.)

Accepted Answer

Enable TLS 1.2 by using the HTTPS InvokeEndpoint API and require the security group to permit only the application's CIDR range on port 443.. Private connectivity comes from attaching the endpoint to VPC private subnets and invoking it through the SageMaker runtime interface VPC endpoint, which keeps traffic off the public internet. In-transit encryption comes from the HTTPS InvokeEndpoint API, while the security group limits which sources can reach the endpoint network interfaces. Capturing data, IAM resource policies, and network isolation do not deliver these transport guarantees.

Answer

Enable network isolation on the endpoint's model container so the container cannot make outbound calls.

Answer

Set the endpoint's DataCaptureConfig to capture 100 percent of requests and responses for auditing.

Answer

Apply an IAM resource policy to the endpoint that denies invocation from any principal outside the VPC.

Question 15

A company stores training data in an Amazon S3 bucket and trains models in SageMaker. Auditors require that all training data be encrypted with a customer managed AWS KMS key and that SageMaker be prevented from reading the bucket unless the request uses that key. Which configuration should the machine learning engineer apply?

Accepted Answer

Enable default encryption on the S3 bucket with SSE-KMS using the customer managed key, and add a bucket policy condition that denies s3:GetObject unless s3:x-amz-server-side-encryption-aws-kms-key-id matches that key ARN.. The auditors specified two things: a customer managed KMS key for data at rest, and enforcement that reads use that key. SSE-KMS with the customer managed key delivers the first, and a bucket policy condition on s3:x-amz-server-side-encryption-aws-kms-key-id delivers the second by denying object reads that do not specify the expected key. AWS managed keys and SSE-S3 cannot satisfy the named-key requirement.

Answer

Enable default encryption with SSE-KMS using the customer managed key and grant the SageMaker execution role kms:Decrypt on all KMS keys in the account.

Answer

Enable default encryption with SSE-KMS using an AWS managed key and add a bucket policy that requires aws:SecureTransport to be true.

Answer

Enable default encryption on the S3 bucket with SSE-S3 and attach a bucket policy that denies s3:GetObject when the request is not over TLS.