MLS-C01 Practice Question: Machine Learning Implementation and Operations
A company is deploying a machine learning model to an Amazon SageMaker endpoint. The model receives requests with sensitive data that must be encrypted in transit and at rest. Additionally, the company needs to control access to the endpoint using AWS IAM. Which THREE steps should the company take to meet these requirements? (Choose THREE.)
⚠ Common exam trap
Many candidates confuse encryption at rest for model artifacts in S3 (Option C) with encryption at rest for the endpoint's ML storage volume, which is a separate requirement; the exam tests whether you know that the endpoint's storage volume encryption is configured at the endpoint level, not via S3 SSE-S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable HTTPS for the endpoint
Enabling HTTPS for the SageMaker endpoint encrypts data in transit using TLS/SSL. SageMaker endpoints support HTTPS by default when using the InvokeEndpoint API, and you can enforce HTTPS by configuring a custom VPC and security group to only allow HTTPS traffic. Option D is correct because encryption at rest for the endpoint's ML storage volume can be enabled by specifying an AWS KMS key when creating the endpoint configuration. This encrypts the temporary storage used during inference. Option E is correct by attaching a resource-based IAM policy to the endpoint to control which IAM principals (users, roles) can invoke the endpoint, meeting access control requirements. Option B is incorrect because using a VPC is not required for encryption or access control; it provides network isolation but does not directly enforce HTTPS or IAM access. Option C is incorrect because SSE-S3 encrypts model artifacts in S3, not the endpoint's ML storage volume; encryption at rest for the endpoint must be configured at the endpoint level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable HTTPS for the endpoint
Why this is correct
HTTPS encrypts data in transit.
- ✗
Configure the endpoint to use a VPC
Why it's wrong here
VPC provides network isolation, not encryption.
- ✗
Store the model artifacts in Amazon S3 with SSE-S3 encryption
Why it's wrong here
SSE-S3 is less secure; SSE-KMS is preferred for sensitive data.
- ✓
Enable encryption at rest for the endpoint's ML storage volume
Why this is correct
Encryption at rest protects data stored on the endpoint.
- ✓
Attach an IAM policy to the endpoint to allow only authorized principals
Why this is correct
IAM policies control access to the endpoint.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.