mediumMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: A company uses Amazon SageMaker to build and…
A company uses Amazon SageMaker to build and deploy machine learning models. The security team has implemented a policy that all SageMaker notebook instances must be launched in a VPC and cannot have direct internet access. However, data scientists need to download open-source datasets from the internet for model training. They also need to install Python packages from PyPI. Currently, the SageMaker notebook instances are in a VPC with no internet gateway. The data scientists cannot download any external data or packages. The VPC has a NAT gateway already configured. What should the company do to allow the necessary internet access while maintaining the security requirement?
⚠ Common exam trap
Many candidates confuse VPC endpoints (which only work for AWS services like S3 or DynamoDB) with a general internet access solution, forgetting that PyPI and arbitrary websites are not AWS services and thus cannot be reached via VPC endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a route from the private subnets to the NAT gateway for 0.0.0.0/0.
The VPC already has a NAT gateway configured, but the private subnets lack a route to it for internet-bound traffic. By adding a route from the private subnets to the NAT gateway for destination 0.0.0.0/0, outbound traffic from the SageMaker notebook instances can reach the internet (e.g., to download datasets from open-source sites and install packages from PyPI) while the instances remain in a private subnet without direct internet access, satisfying the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an internet gateway to the VPC and add a route to the internet gateway in the subnet's route table.
Why it's wrong here
An internet gateway would allow inbound connections from the internet, violating the no direct internet access policy.
- ✗
Place the notebook instances in a public subnet and configure security group rules to restrict inbound traffic.
Why it's wrong here
Public subnets have direct internet access via internet gateway, which violates the policy.
- ✗
Create a VPC endpoint for S3 and a VPC endpoint for PyPI, and route traffic through them.
Why it's wrong here
VPC endpoints only work for AWS services and some supported services; there is no VPC endpoint for PyPI.
- ✓
Add a route from the private subnets to the NAT gateway for 0.0.0.0/0.
Why this is correct
NAT gateway provides outbound internet access for private subnets, allowing downloads without direct inbound access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AIF-C01 question from scratch — 619 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.