hardMultiple SelectObjective-mapped
AIF-C01 Practice Question: A company uses Amazon SageMaker to build and…
A company uses Amazon SageMaker to build and deploy models. They want to enforce compliance that all model endpoints are encrypted in transit and use least privilege access. Which THREE steps should they take? (Choose THREE.)
⚠ Common exam trap
Test-takers frequently confuse logging (CloudTrail) with enforcement of encryption or access control, or they mistakenly think disabling root access on notebooks affects endpoint security, when in fact it only secures the development environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the SageMaker endpoint to use a custom SSL certificate via AWS Certificate Manager
Configuring a SageMaker endpoint to use a custom SSL certificate from AWS Certificate Manager (ACM) ensures that all data transmitted between clients and the endpoint is encrypted in transit using TLS. This enforces the compliance requirement for encryption in transit by replacing the default SageMaker certificate with a customer-managed certificate, which can be validated and rotated as needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the SageMaker endpoint to use a custom SSL certificate via AWS Certificate Manager
Why this is correct
This ensures HTTPS for encryption in transit.
- ✓
Use an interface VPC endpoint (AWS PrivateLink) for SageMaker
Why this is correct
This allows the endpoint to be accessed privately within the VPC, avoiding internet exposure.
- ✓
Attach an IAM policy to the execution role that only allows specific actions on the endpoint
Why this is correct
Least privilege access is enforced via IAM.
- ✗
Enable AWS CloudTrail to log all endpoint invocations
Why it's wrong here
CloudTrail logs are for auditing, not encryption or access control.
- ✗
Disable root access on the SageMaker notebook instances
Why it's wrong here
Notebook instances are not directly relevant to endpoint security.
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.