hardMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: A financial services company is deploying a fraud…
A financial services company is deploying a fraud detection model using Amazon SageMaker. They need to ensure that inference requests are encrypted in transit and that the model endpoint is only accessible from within a VPC. What is the MOST secure way to achieve this?
⚠ Common exam trap
Watch out — candidates often confuse 'deploying in a private subnet' with 'making the endpoint accessible within the VPC'—a SageMaker endpoint in a private subnet without an internet gateway or VPC endpoint cannot be reached because the SageMaker service itself needs a network path to invoke the endpoint, and without a VPC endpoint, the endpoint is effectively isolated and unreachable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the model endpoint in a VPC with an interface VPC endpoint (AWS PrivateLink) and configure the model to require HTTPS
It combines two critical security controls: deploying the SageMaker endpoint within a VPC using an interface VPC endpoint (AWS PrivateLink) ensures that all traffic stays within the AWS network and never traverses the public internet, while configuring the model to require HTTPS enforces encryption in transit. This architecture eliminates exposure to the internet and meets the requirement for encrypted inference requests and VPC-only access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable public endpoint with TLS and restrict access using a VPN
Why it's wrong here
Public endpoint still leaves the endpoint internet-facing; a VPN is additional but less secure than VPC isolation.
- ✗
Use SageMaker Model Monitor to detect anomalies in request data
Why it's wrong here
Model Monitor monitors data quality, not encryption or network access.
- ✗
Create a SageMaker endpoint in a private subnet without an internet gateway, and use AWS PrivateLink
Why it's wrong here
PrivateLink is correct but the endpoint itself can be accessed via PrivateLink without HTTPS; you still need TLS.
- ✓
Deploy the model endpoint in a VPC with an interface VPC endpoint (AWS PrivateLink) and configure the model to require HTTPS
Why this is correct
This ensures traffic stays within the VPC and uses TLS encryption in transit.
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.