hardMultiple ChoiceObjective-mapped
Restrict SageMaker Endpoint to VPC
A company uses Amazon SageMaker to host a real-time inference endpoint. The model was trained on sensitive data, and the company wants to ensure that the data sent to the endpoint is encrypted in transit. Additionally, the company wants to restrict access to the endpoint to only traffic originating from a specific VPC. Which configuration meets these requirements?
Quick Answer
The correct configuration is to create the SageMaker endpoint inside a VPC, attach a security group that allows inbound HTTPS traffic only from the VPC’s CIDR range, and enable HTTPS for the endpoint. This works because placing the endpoint within the VPC makes it accessible only via private IP addresses, while the security group acts as a virtual firewall to block any traffic originating outside the specified CIDR. Enforcing HTTPS then encrypts all data in transit using TLS, satisfying both the encryption and VPC-restriction requirements. On the AWS Certified AI Practitioner AIF-C01 exam, this scenario tests your understanding of how to combine network-level controls with encryption to secure sensitive model inference—a common trap is assuming that simply enabling HTTPS alone restricts access, or that a public endpoint with a security group is sufficient. Remember the memory tip: “VPC for the fence, HTTPS for the lock.”
⚠ Common exam trap
It's easy for candidates to think mTLS or signed requests alone satisfy both encryption and VPC restriction, but they fail to realize that network-level access control (security group with VPC CIDR) is required to restrict traffic to a specific VPC, and HTTPS is needed for encryption in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the SageMaker endpoint in a VPC, associate a security group that allows inbound HTTPS from the VPC CIDR, and configure the endpoint to use HTTPS
Creating the SageMaker endpoint within a VPC and associating a security group that restricts inbound HTTPS traffic to the VPC CIDR ensures that only traffic from within that VPC can reach the endpoint. Configuring the endpoint to use HTTPS encrypts data in transit using TLS, meeting both the encryption and VPC-only access requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create the SageMaker endpoint in a VPC, associate a security group that allows inbound HTTPS from the VPC CIDR, and configure the endpoint to use HTTPS
Why this is correct
VPC placement restricts network access; HTTPS encrypts data in transit.
- ✗
Configure the SageMaker endpoint to use mutual TLS (mTLS) with client certificates
Why it's wrong here
SageMaker endpoints do not support mTLS; VPC placement is the standard method.
- ✗
Place the SageMaker endpoint behind an Amazon CloudFront distribution with an origin access identity
Why it's wrong here
CloudFront does not enforce VPC origin; clients can access CloudFront from anywhere.
- ✗
Use AWS STS to generate temporary credentials and require the client to sign requests with them
Why it's wrong here
Signing requests does not restrict network origin; requests can come from anywhere.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AIF-C01 question from scratch — 619 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AIF-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team is using Amazon SageMaker to deploy a real-time inference endpoint. The endpoint must be accessible only from a specific IP range and must automatically scale based on request volume. Which configuration meets these requirements?
medium- A.Deploy the endpoint in a public subnet with a security group allowing the IP range.
- ✓ B.Configure the endpoint with a VPC and attach a security group that allows inbound traffic from the IP range, and enable automatic scaling for the endpoint.
- C.Deploy the endpoint with a VPC and use a Network Load Balancer with target group health checks.
- D.Deploy the endpoint with an AWS WAF ACL to filter by IP and enable auto scaling for the endpoint.
Why B: Amazon SageMaker endpoints can be deployed within a VPC, allowing you to attach a security group that restricts inbound traffic to a specific IP range. Additionally, SageMaker supports automatic scaling for real-time endpoints using Application Auto Scaling, which adjusts the number of instances based on request volume metrics like InvocationsPerInstance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.