mediumMultiple SelectObjective-mapped
AIF-C01 Practice Question: Using Amazon SageMaker to train machine learning…
A company is using Amazon SageMaker to train machine learning models. The security team wants to ensure that the training data is encrypted at rest and that the SageMaker notebook instances cannot access the internet. Which TWO actions should the company take? (Choose TWO.)
⚠ Common exam trap
Watch out — candidates often confuse encryption at rest for the endpoint (Option C) with encryption of the training data in S3, or they mistakenly think that CloudTrail logging (Option B) or STS credentials (Option E) provide encryption, when in fact they address auditing and access control, not data encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 server-side encryption with AWS KMS (SSE-KMS) for the training data bucket
Enabling S3 server-side encryption with AWS KMS (SSE-KMS) ensures that the training data stored in the S3 bucket is encrypted at rest. This satisfies the security team's requirement for data encryption at rest, as SSE-KMS provides envelope encryption with a customer-managed or AWS-managed KMS key, giving the company control over the encryption keys and auditability via AWS CloudTrail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable S3 server-side encryption with AWS KMS (SSE-KMS) for the training data bucket
Why this is correct
SSE-KMS encrypts objects at rest using KMS keys.
- ✗
Create an AWS CloudTrail trail to log all S3 data events
Why it's wrong here
CloudTrail logs access, but does not provide encryption.
- ✗
Enable encryption at rest for the SageMaker endpoint using the AWS Management Console
Why it's wrong here
SageMaker endpoint encryption at rest applies to the ML storage volume, not the training data in S3.
- ✓
Disable internet access for the SageMaker notebook instance by placing it in a VPC without a NAT gateway or internet gateway
Why this is correct
This prevents the notebook from reaching the internet.
- ✗
Use AWS Security Token Service (STS) to generate temporary credentials for the notebook instance
Why it's wrong here
STS provides credentials, but does not control internet access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.