A company needs to secure data used for training machine learning models in Amazon SageMaker. Which TWO actions should be taken to protect data at rest and in transit? (Choose TWO.)
This encrypts data at rest in S3.
Why this answer
Enabling default encryption on S3 buckets using AWS KMS ensures that all objects stored in the bucket are encrypted at rest. This is a fundamental security practice for protecting training data in SageMaker, as SageMaker reads data from S3. Using AWS KMS allows you to manage and audit encryption keys, providing fine-grained control over data protection.
Exam trap
AWS often tests the distinction between data protection mechanisms (encryption) and other security controls (access management, model governance), leading candidates to confuse disabling root access or using Model Registry with data encryption requirements.