AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions

A data scientist needs to restrict access to a SageMaker notebook instance to only the corporate network. Which configuration should they use?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Place the notebook instance in a VPC and configure security groups to allow only corporate IP ranges

VPC isolation places the notebook instance inside a VPC, and security groups can restrict inbound traffic to the corporate network IP range.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable multi-factor authentication for the notebook
Why it's wrong here
MFA adds authentication security but does not restrict network access.
✗
Use an IAM policy to allow only corporate users
Why it's wrong here
IAM controls who can access the notebook but does not restrict network-level access.
✓
Place the notebook instance in a VPC and configure security groups to allow only corporate IP ranges
Why this is correct
VPC placement and security groups enforce network-level restrictions.
✗
Use a SageMaker lifecycle configuration to block external IPs
Why it's wrong here
Lifecycle configurations run scripts at startup but cannot enforce network-level restrictions.

Go deeper