MLA-C01 ML Solution Monitoring, Maintenance, and Security Practice Test 5 — 15 Questions

Question 1

A team operates a SageMaker real-time endpoint for fraud scoring. A security review requires that inference requests and responses be logged, that the endpoint be reachable only through a VPC interface endpoint, and that all API calls made by the team's automation be attributable to a specific non-human identity. The team already uses SageMaker Data Capture writing to Amazon S3. Which TWO additional actions best satisfy the remaining requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with a trust policy scoped to the automation platform and use temporary credentials from AWS STS for every API call instead of long-lived access keys.. Private reachability is achieved with a SageMaker runtime interface endpoint plus network isolation on the model, and caller attribution is achieved by giving the automation its own IAM role assumed via AWS STS so CloudTrail records a distinct session identity. The other actions address adjacent concerns such as at-rest encryption, storage auditing, or container permissions.

Answer

Configure the endpoint with a customer managed AWS KMS key for volume encryption and rotate the key annually through AWS KMS automatic rotation.

Answer

Attach an IAM policy to the endpoint's execution role that allows sagemaker:InvokeEndpoint so that the automation can call the endpoint.

Answer

Enable AWS CloudTrail data events for the S3 bucket that receives the Data Capture records so that each captured object write is logged.

Question 2

A machine learning engineer must ensure that only a specific application running in a partner AWS account can invoke a SageMaker real-time endpoint, while other accounts are denied even if they obtain the endpoint name. The engineer wants the control enforced at the endpoint itself rather than relying only on the caller's identity policy. Which approach meets this requirement?

Accepted Answer

Create a VPC interface endpoint for SageMaker Runtime in the partner's VPC, apply an endpoint policy that allows only the specific application's role to call InvokeEndpoint, and keep the endpoint private.. PrivateLink interface endpoints for SageMaker Runtime let the partner invoke the endpoint over the AWS private network, and the endpoint policy narrows which principals and actions may pass through that path. Because the endpoint is not publicly reachable, callers outside the approved VPC cannot invoke it regardless of their identity policies, which is the resource-side enforcement the engineer requested.

Answer

Enable SageMaker network isolation on the endpoint and grant the partner account sagemaker:InvokeEndpoint in an IAM identity policy.

Answer

Attach a resource-based policy to the endpoint that allows sagemaker:InvokeEndpoint for the partner account's principal and rely on the default implicit deny for everyone else.

Answer

Configure the endpoint with a custom domain name and issue an ACM certificate, then require the partner to present a client certificate on every call.

Question 3

A financial services company has deployed an XGBoost model on a SageMaker real-time endpoint to approve or decline loan applications. The company must prove to auditors that no individual applicant's data was memorized by the model and that predictions cannot be reverse-engineered to reveal training records. Which SageMaker feature should they enable to generate a report that quantifies the model's exposure to membership inference and other privacy risks?

Accepted Answer

SageMaker Clarify with the SageMaker ML privacy protection and model monitoring settings. SageMaker Clarify offers a dedicated privacy protection capability that generates a model privacy report containing membership inference metrics. This is the only option that measures whether an attacker could determine if a specific record was used during training. The other features address explainability, operational visibility, or data drift, none of which produce quantifiable privacy-risk evidence for auditors.

Answer

SageMaker Model Dashboard

Answer

SageMaker Clarify explainability with SHAP

Answer

SageMaker Model Monitor data quality monitoring

Question 4

A healthcare technology company uses a SageMaker endpoint to serve a model that predicts patient deterioration. They must ensure that all inference requests and responses are encrypted in transit and that the endpoint cannot be accessed from the public internet. They also need to log every invocation for audit purposes. Which combination of configurations should they implement?

Accepted Answer

Deploy the endpoint with a VPC configuration, enable AWS PrivateLink, and enable SageMaker Endpoint invocation logging to CloudWatch Logs.. Placing the endpoint in a VPC with AWS PrivateLink ensures that traffic stays on the AWS private network, never traversing the public internet, and is encrypted in transit. Enabling invocation logging sends request and response data to CloudWatch Logs, creating an audit trail. The other options either do not restrict public access, do not encrypt in transit, or do not log the required invocation details.

Answer

Deploy the endpoint with data capture enabled to Amazon S3 and enable AWS CloudTrail data events for SageMaker.

Answer

Deploy the endpoint with an IAM resource policy that denies all principals except a specific role, and enable encryption at rest using AWS KMS.

Answer

Deploy the endpoint with network isolation enabled, and configure SageMaker Model Monitor to log all requests.

Question 5

A company is deploying a SageMaker real-time endpoint that must be secured so that only a specific IAM role used by an internal application can invoke it, and all data at rest for the endpoint's underlying storage must be encrypted with a customer-managed AWS KMS key. The endpoint also must not have any public internet access. Which TWO configurations should they implement? (Choose two.)

Accepted Answer

Attach an IAM resource policy to the endpoint that allows only the specific IAM role to perform sagemaker:InvokeEndpoint.. To restrict invocation to a specific IAM role, an IAM resource policy on the endpoint is the correct mechanism. To eliminate public internet access, deploying the endpoint in a VPC with private subnets ensures it has no public IP. Encryption at rest for the endpoint's storage is not a separate configuration because SageMaker endpoints do not have persistent EBS volumes; model artifacts are encrypted in S3, which can be secured with a KMS key, but that is not listed as a correct option here.

Answer

Attach an IAM policy to the endpoint's execution role that grants access to the customer-managed KMS key for encryption.

Answer

Enable server-side encryption with a customer-managed AWS KMS key for the SageMaker endpoint's Amazon EBS volumes.

Answer

Enable network isolation on the endpoint container.

Question 6

A machine learning engineer is monitoring a deployed model for data drift. The input features are a mix of categorical and numerical columns. The baseline is from the training data. Which SageMaker Model Monitor feature should they enable to detect changes in the distribution of each feature over time?

Accepted Answer

Data quality monitoring. Data quality monitoring in SageMaker Model Monitor compares the statistical distribution of each input feature (both numerical and categorical) against a baseline computed from the training data, detecting drift in feature distributions over time. It supports categorical and numerical columns and is the correct feature for detecting per-feature distribution changes.

Answer

Bias drift monitoring

Answer

Model quality monitoring

Answer

Feature attribution drift monitoring

Question 7

A team receives alerts that their SageMaker endpoint latency has increased significantly. They check CloudWatch metrics and see Invocations rising, but ModelLatency remains stable. Which metric should they investigate to find the source of the increased latency?

Accepted Answer

OverheadLatency. OverheadLatency measures the time taken by the SageMaker infrastructure to handle requests before and after model inference, including request routing, authentication, and response processing. Since ModelLatency is stable but total endpoint latency has increased, the extra time must be in the overhead component, making OverheadLatency the correct metric to investigate.

Answer

ModelLatency

Answer

5XXError

Answer

4XXError

Question 8

A data scientist wants to track the lineage of models, datasets, and training jobs in SageMaker. Which SageMaker feature should they use to capture these relationships as artifacts and actions?

Accepted Answer

SageMaker ML Lineage Tracking. SageMaker ML Lineage Tracking creates a graph of artifacts (datasets, models) and actions (training jobs, endpoints) to track the provenance of ML workflows.

Answer

SageMaker Model Registry

Answer

SageMaker Experiments

Answer

SageMaker Feature Store

Question 9

A team has deployed a real-time inference endpoint and wants to automatically scale based on CPU utilization. Which scaling policy type should they use with Application Auto Scaling for SageMaker endpoints?

Accepted Answer

Target tracking scaling. Target tracking scaling is correct because it adjusts capacity to keep a specified metric, such as CPU utilization, at a target value. Application Auto Scaling for SageMaker endpoints supports target tracking, which automatically creates and manages the necessary CloudWatch alarms and scaling policies. This is the recommended approach for maintaining a utilization target without manually defining step adjustments.

Answer

Step scaling

Answer

Predictive scaling

Answer

Simple scaling

Question 10

A company deploys a model for fraud detection. They need to monitor for bias after deployment, specifically whether the model's false positive rate changes across demographic groups over time. Which SageMaker feature should they use?

Accepted Answer

SageMaker Clarify (post-deployment bias monitoring). SageMaker Clarify provides post-deployment bias monitoring by analyzing predictions against ground truth labels for defined facets. It can track metrics like false positive rate differences over time.

Answer

SageMaker Model Monitor – Model Quality

Answer

SageMaker Model Monitor – Feature Attribution Drift

Answer

SageMaker Model Monitor – Data Quality

Question 11

A company wants to reduce costs for a production SageMaker endpoint that has predictable traffic patterns. They have purchased a Savings Plan. What additional step can they take to further optimize costs while maintaining performance?

Accepted Answer

Use SageMaker Inference Recommender to right-size the endpoint. SageMaker Inference Recommender runs load tests against candidate instance types and configurations to identify the most cost-effective endpoint that still meets latency and throughput requirements. Since the Savings Plan already discounts compute, right-sizing the underlying instance fleet is the remaining lever for cost optimization without sacrificing performance. This directly addresses the 'maintaining performance' constraint that rules out simply shrinking capacity.

Answer

Reduce the number of instances to one, regardless of load

Answer

Switch from real-time to batch inference

Answer

Disable auto-scaling

Question 12

A company uses SageMaker Model Monitor for data quality. They notice that monitoring jobs are failing intermittently with constraint violations. Upon review, they see that some features have different data types in production compared to the baseline (e.g., string instead of integer). Which type of drift is this?

Accepted Answer

Schema drift. Schema drift occurs when the structure or data types of features in production data differ from the baseline used during model training. In this scenario, a feature that was an integer in the baseline is now a string in production, which is a classic example of schema drift. SageMaker Model Monitor detects this by comparing the inferred schema of production data against the baseline schema, flagging any type mismatches as constraint violations.

Answer

Concept drift

Answer

Statistical drift

Answer

Bias drift

Question 13

A team wants to monitor the number of requests and latency of their SageMaker endpoint using a unified dashboard. Which AWS service should they use to create a custom dashboard with these metrics?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards is the native AWS service for building custom, unified dashboards from CloudWatch metrics. SageMaker automatically publishes endpoint metrics such as Invocations, ModelLatency, OverheadLatency, and Invocation4XXErrors to CloudWatch, so a CloudWatch dashboard can display requests and latency side by side.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

SageMaker Studio

Question 14

A company uses SageMaker JumpStart to deploy a foundation model for a summarization task. They want to minimize costs while still meeting a latency requirement of under 2 seconds. Which option should they consider?

Accepted Answer

Use SageMaker Inference Recommender to select the cheapest instance that meets latency. SageMaker Inference Recommender runs load tests against your model on various instance types and provides latency and cost metrics. By selecting the cheapest instance that still meets the sub-2-second latency requirement, you directly minimize cost while satisfying the performance constraint. This is the most systematic and cost-effective approach for this scenario.

Answer

Deploy the model on a serverless endpoint

Answer

Enable auto-scaling to handle variable traffic

Answer

Use the largest GPU instance to ensure fast inference

Question 15

A data science team uses Amazon SageMaker Model Monitor to detect data drift in production. They notice that the schema of incoming data (number of features) has changed compared to the training baseline. Which type of monitor is BEST suited to detect this issue?

Accepted Answer

Data quality monitor. The Data quality monitor in SageMaker Model Monitor is specifically designed to detect violations in the input data schema, such as changes in the number of features, feature types, or missing values, by comparing incoming data against a baseline computed from the training dataset. Since the issue is a structural change in the schema (number of features), the Data quality monitor is the correct choice.

Answer

Bias drift monitor

Answer

Feature attribution drift monitor

Answer

Model quality monitor