hardMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: A company uses Amazon SageMaker for model training
A company uses Amazon SageMaker for model training. To comply with data residency requirements, they must ensure that the training data never leaves a specific AWS region. However, during training, the SageMaker service might use resources in other regions for auto-scaling. Which configuration should they use to enforce data residency?
⚠ Common exam trap
Watch out — candidates often assume VPC endpoints or network isolation are sufficient to enforce regional boundaries, but they do not control the SageMaker control plane's ability to launch resources in other regions; only an SCP or IAM policy with a region condition can enforce that restriction at the API level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Organizations to create an SCP that denies access to SageMaker resources in other regions.
AWS Organizations Service Control Policies (SCPs) can explicitly deny access to SageMaker resources in any region outside the allowed one. By attaching an SCP that denies `sagemaker:*` actions when the `aws:RequestedRegion` condition key does not match the permitted region, the company can enforce data residency at the account level, preventing SageMaker from provisioning resources in other regions even if auto-scaling would otherwise trigger cross-region activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the training job to use only local spot instances and enable network isolation.
Why it's wrong here
Spot instances are still within the same region; this does not address cross-region resource usage.
- ✗
Use Amazon SageMaker's inter-container traffic encryption and disable cross-region data transfer.
Why it's wrong here
There is no such setting to disable cross-region data transfer.
- ✓
Use AWS Organizations to create an SCP that denies access to SageMaker resources in other regions.
Why this is correct
SCPs can explicitly deny SageMaker actions in non-compliant regions, enforcing data residency.
- ✗
Use a VPC with a VPC endpoint for SageMaker and restrict the training job to use only local resources.
Why it's wrong here
VPC endpoints are regional; they do not prevent SageMaker from launching resources in other regions.
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.