CCNA Machine Learning Implementation and Operations Questions — Page 5 of 5

301

MCQeasy

A company wants to track and compare metrics from multiple machine learning experiments. Which Amazon SageMaker feature should be used?

A.SageMaker Experiments

B.SageMaker Ground Truth

C.SageMaker Model Monitor

D.SageMaker Debugger

AnswerA

Specifically designed for experiment tracking and comparison.

Why this answer

SageMaker Experiments is the correct choice for tracking and comparing metrics from multiple machine learning experiments. SageMaker Model Monitor is used to detect data drift, SageMaker Debugger is used to debug training jobs, and SageMaker Ground Truth is used for data labeling. Thus, only option A is correct.

Practice this question →

302

MCQhard

A SageMaker training job log shows the exhibit. The training job fails immediately after starting. The training data is supposed to be provided via Pipe mode from S3. What is the most likely cause?

A.The input data channel is not properly configured

B.The instance type does not have enough memory

C.The S3 bucket has insufficient permissions

D.The training script is using File mode instead of Pipe mode

E.The hyperparameters are incorrectly specified

AnswerA

The training job is looking for data at /opt/ml/input/data/training, but Pipe mode should provide a pipe.

Why this answer

The training job fails immediately after starting, which is characteristic of a Pipe mode configuration issue. In Pipe mode, SageMaker streams data from S3 directly to the algorithm via a Unix FIFO pipe, and if the input data channel is not properly configured (e.g., missing or incorrect S3 path, wrong channel name, or mismatched content type), the training job will fail at launch without any data being read. The log exhibit likely shows an error such as 'Unable to read from pipe' or 'NoSuchKey', confirming the channel misconfiguration.

Exam trap

The key distinction is between immediate job failures (caused by infrastructure configuration like Pipe mode channels) versus runtime failures (caused by permissions, memory, or hyperparameters), leading candidates to mistakenly attribute the error to S3 permissions or script issues.

How to eliminate wrong answers

Option B is wrong because insufficient memory would cause an out-of-memory error during training, not an immediate failure at job start—SageMaker would still initialize the instance and load the script. Option C is wrong because insufficient S3 permissions would produce an AccessDenied error in the logs, but the question states the job fails immediately after starting, which aligns with a channel configuration issue, not a permissions error (permissions are checked at data access time, not at job launch). Option D is wrong because the training script's mode (File vs.

Pipe) is irrelevant—Pipe mode is configured in the channel definition in the SageMaker API or SDK, not in the script itself; the script simply reads from the pipe. Option E is wrong because incorrect hyperparameters would cause a runtime error during model training (e.g., invalid value), not an immediate failure at job start—the job would still begin execution.

Practice this question →

303

MCQhard

A company has deployed a machine learning model on Amazon SageMaker for real-time inference. The endpoint uses a single ml.c5.xlarge instance. Recently, the traffic has increased, and the endpoint is returning HTTP 503 (Service Unavailable) errors during peak hours. The CloudWatch metrics show that the CPU utilization is consistently above 90% during peak times, and the Invocations metric shows that requests are being throttled. The data science team has already optimized the model to reduce inference time by 20%, but the errors persist. The company needs to resolve the issue without increasing costs significantly. Which course of action should be taken?

A.Change the instance type to a larger size, such as ml.c5.2xlarge

B.Switch to batch transform to process requests in batches

C.Use spot instances to reduce costs and add more instances

D.Configure auto-scaling for the endpoint to add instances based on CPU utilization

AnswerD

Auto-scaling adds instances only when needed, handling peak traffic and reducing costs during low traffic.

Why this answer

Configuring auto-scaling for the endpoint based on CPU utilization dynamically adjusts the number of instances to handle increased traffic, reducing HTTP 503 errors without incurring high costs during low traffic. Option A is wrong because upgrading to a larger instance type (e.g., ml.c5.2xlarge) would increase costs even during low-traffic periods, which does not align with the goal of minimizing cost increases. Option B is wrong because batch transform is designed for offline, asynchronous processing, not real-time inference as required here.

Option C is wrong because spot instances can be interrupted and reclaimed by AWS, leading to potential service disruptions, and merely adding more instances without scaling logic does not solve the capacity issue efficiently.

Practice this question →

304

MCQhard

A company is using Amazon SageMaker to host a model that performs real-time inference. The model receives around 100 requests per second with occasional spikes up to 500 requests per second. The current endpoint uses 2 ml.m5.large instances. During spikes, latency increases significantly, and some requests time out. What is the MOST cost-effective solution to handle the spikes without losing requests?

A.Replace the instances with a single larger instance type, such as ml.m5.4xlarge

B.Use an Amazon SQS queue to buffer incoming requests and process them asynchronously

C.Use AWS Lambda with a provisioned concurrency to handle the spikes

D.Configure SageMaker managed scaling with a target tracking policy and add a buffer based on the average spike duration

AnswerD

Managed scaling with a buffer allows proactive scaling to handle spikes.

Why this answer

SageMaker managed scaling with a target tracking policy automatically adjusts the number of instances based on a specified metric (e.g., invocation count or latency), and adding a buffer based on the average spike duration ensures that additional capacity is provisioned before the spike hits, preventing timeouts. This is the most cost-effective approach as it scales out during spikes and scales in during normal load, avoiding over-provisioning.

Exam trap

The trap here is that candidates often choose Option A (scaling up) thinking it simplifies management, but they overlook that vertical scaling (larger instance) does not inherently improve throughput under bursty traffic if the bottleneck is request handling concurrency, and it wastes cost during low load.

How to eliminate wrong answers

Option A is wrong because replacing two ml.m5.large instances with a single ml.m5.4xlarge (which has equivalent vCPU and memory) does not increase total capacity; it only consolidates resources, so the endpoint would still be unable to handle spikes up to 500 requests per second without increased latency and timeouts. Option B is wrong because using an SQS queue with asynchronous processing changes the architecture from real-time inference to batch processing, which violates the requirement for real-time inference and introduces unbounded latency for the client. Option C is wrong because AWS Lambda with provisioned concurrency is designed for stateless, short-lived functions, not for hosting a persistent SageMaker model; it would require significant re-architecture and does not natively integrate with SageMaker endpoints for real-time inference.

Practice this question →

305

MCQmedium

A data scientist is using SageMaker to train a deep learning model. The training script uses TensorFlow and runs on a single p3.2xlarge instance. The scientist wants to reduce training time by using multiple GPUs. What should the scientist do?

A.Increase the instance count to 4 without changing the script.

B.Modify the training script to use Horovod for distributed training.

C.Switch to PyTorch framework.

D.Use SageMaker Managed Spot Training.

AnswerB

Horovod enables multi-GPU and multi-instance distributed training.

Why this answer

Horovod is a distributed deep learning framework that integrates with TensorFlow to enable multi-GPU training across multiple instances. By modifying the training script to use Horovod's `hvd.DistributedOptimizer` and broadcasting initial variables, the data scientist can leverage multiple GPUs on a single p3.2xlarge instance (which has 1 GPU) or scale to multiple instances, directly reducing training time through data parallelism.

Exam trap

The trap here is that candidates assume increasing instance count or switching frameworks automatically enables multi-GPU training, but AWS tests the understanding that distributed training requires explicit code changes (e.g., Horovod or DDP) and that a single p3.2xlarge instance has only one GPU, so multi-GPU training requires a different instance type or multiple instances.

How to eliminate wrong answers

Option A is wrong because simply increasing the instance count to 4 without modifying the script does not enable distributed training; TensorFlow by default runs on a single device, so additional instances would remain idle or cause errors. Option C is wrong because switching to PyTorch does not automatically enable multi-GPU training; the script would still need to be modified to use PyTorch's distributed data parallel (DDP) or Horovod. Option D is wrong because SageMaker Managed Spot Training reduces cost by using spot instances, not training time; it does not provide multi-GPU parallelism.

Practice this question →

306

MCQmedium

During training of a deep learning model on a GPU instance in SageMaker, the training job fails with an insufficient memory error. Which step should be taken first to resolve this issue?

A.Add dropout layers

B.Use a smaller learning rate

C.Use gradient clipping

D.Reduce the batch size

AnswerD

Smaller batch size reduces GPU memory footprint.

Why this answer

The most direct cause of an out-of-memory (OOM) error during GPU training is that the combined size of the model parameters, activations, and gradients exceeds the GPU's VRAM. Reducing the batch size immediately decreases the memory footprint of activations stored for backpropagation, which is the largest and most tunable memory consumer. This is the first and simplest step to resolve the error without altering the model architecture or training dynamics.

Exam trap

The MLS-C01 exam often tests the misconception that hyperparameter tuning (learning rate) or regularization (dropout) can fix memory errors, when in fact only batch size or model size directly control VRAM usage.

How to eliminate wrong answers

Option A is wrong because adding dropout layers does not reduce memory usage; dropout only affects the forward pass by randomly zeroing activations, but the model's parameter count and activation storage remain the same. Option B is wrong because using a smaller learning rate does not affect memory consumption; it only changes the step size during optimization and has no impact on VRAM usage. Option C is wrong because gradient clipping limits the magnitude of gradients to prevent exploding gradients, but it does not reduce the memory required to store gradients or activations.

Practice this question →

307

MCQeasy

An engineer sees the error in the exhibit when trying to deploy a model from a model registry in SageMaker. What is the MOST likely cause?

A.The IAM role lacks permission to access the model registry

B.The model package version does not exist in the registry

C.The model package is still in 'Approved' status

D.The SageMaker endpoint is already deployed with the same model

AnswerB

The ARN includes a version number; the error says 'Could not find'.

Why this answer

The error in the exhibit indicates that the model package ARN does not exist in the registry. This occurs when the model package version has not been successfully created or registered, meaning it does not exist. Option B is therefore correct: the model package version does not exist.

Option A would result in an access denied error, not this ARN-not-found error. Option C is incorrect because an 'Approved' status is actually required for deployment, so it would not cause this error. Option D would produce a different error about an existing endpoint configuration or conflict, not a missing ARN.

Practice this question →

308

Multi-Selectmedium

A company is using Amazon SageMaker to run a hyperparameter tuning job. The tuning job uses Bayesian optimization. Which THREE statements about Bayesian optimization are correct? (Choose THREE.)

Select 3 answers

A.It can only handle a maximum of 5 hyperparameters

B.It works well for continuous hyperparameters

C.It selects hyperparameter combinations based on previous trial results

D.It often finds optimal hyperparameters in fewer trials than random search

E.It requires more trials than grid search to find optimal values

AnswersB, C, D

Bayesian optimization handles continuous parameters naturally.

Why this answer

Options B, C, and D are correct. Bayesian optimization uses past trial results to select hyperparameter combinations (C), it works well for continuous hyperparameters (B), and it typically finds optimal values in fewer trials than random search (D). Option A is false because Bayesian optimization can handle many hyperparameters, not just 5.

Option E is false because Bayesian optimization generally requires fewer trials than grid search, not more.

Practice this question →

309

MCQhard

A company uses Amazon SageMaker to train a model. The training job uses a custom Docker container. The job fails with the error 'CannotStartContainerError: API error (500).' Which of the following is the most likely cause?

A.The Docker image is built for a different CPU architecture.

B.The training script has a syntax error.

C.The S3 input data is missing.

D.The output path is not writable.

AnswerA

Incompatible architecture prevents container from running.

Why this answer

The error 'CannotStartContainerError: API error (500)' occurs when the Docker daemon on the SageMaker training instance fails to start the container. The most common cause is a CPU architecture mismatch: if the Docker image is built for a different architecture (e.g., ARM64) than the SageMaker training instance (which uses x86_64), the container cannot execute. SageMaker training instances are x86_64-based, so an image built for ARM64 will trigger this error at container launch time.

Exam trap

The trap here is that candidates confuse container start errors with runtime errors — they often pick 'syntax error' or 'missing data' because those are common training failures, but the specific Docker API error points to a pre-execution infrastructure issue, not a code or data problem.

How to eliminate wrong answers

Option B is wrong because a syntax error in the training script would cause a Python runtime error during execution, not a container start failure — the container would start successfully and then fail. Option C is wrong because missing S3 input data would result in a 'FileNotFoundError' or S3 access error during training, not a Docker API error at container start. Option D is wrong because an unwritable output path would cause a permission error or 'OSError' during the training job, not a container initialization failure — the container would start and then fail to write output.

Practice this question →

310

MCQmedium

A company wants to deploy a machine learning model that performs real-time inference with sub-second latency. The model is a deep neural network with 500 MB of weights. The inference endpoint must scale to zero when not in use to minimize cost. Which AWS service should the company use?

A.Deploy the model as an AWS Lambda function with provisioned concurrency.

B.Use Amazon SageMaker Serverless Inference to host the model.

C.Host the model on Amazon ECS with Fargate and use a target tracking scaling policy.

D.Create an Amazon SageMaker real-time endpoint with automatic scaling policies.

AnswerB

SageMaker Serverless Inference automatically scales to zero when idle, reducing costs, and can handle sub-second latency for suitable workloads. It also supports large model sizes.

Why this answer

Amazon SageMaker Serverless Inference is designed for workloads with intermittent traffic patterns, automatically scaling to zero when idle and scaling up for real-time requests. It supports models up to 1 GB in size and provides sub-second latency for inference, making it ideal for this 500 MB deep neural network. This service eliminates the need to manage underlying infrastructure while meeting the latency and cost requirements.

Exam trap

The trap here is that candidates often confuse SageMaker Serverless Inference with SageMaker real-time endpoints, assuming automatic scaling can reduce costs to zero, but real-time endpoints always require a minimum instance count, whereas Serverless Inference truly scales to zero.

How to eliminate wrong answers

Option A is wrong because AWS Lambda has a maximum deployment package size of 250 MB (unzipped, including layers) and a 15-minute execution timeout, making it unsuitable for a 500 MB model and real-time inference with sub-second latency. Option C is wrong because Amazon ECS with Fargate does not natively scale to zero; it requires at least one running task to handle requests, and target tracking scaling policies maintain a baseline capacity, incurring costs even when idle. Option D is wrong because Amazon SageMaker real-time endpoints with automatic scaling policies cannot scale to zero; they maintain a minimum number of instances to ensure availability, leading to ongoing costs when not in use.

Practice this question →

311

MCQhard

An ML engineer is deploying a model on a SageMaker endpoint and wants to ensure that only authorized users and services can invoke the endpoint. The company uses AWS IAM for access control and requires that the endpoint be invoked only from within a specific VPC. What combination of actions should the engineer take? (Choose the single best answer.)

A.Use AWS CloudFront to restrict access based on IP addresses.

B.Use API Gateway in front of the SageMaker endpoint and attach a resource policy to API Gateway.

C.Create a VPC endpoint for Amazon SageMaker and attach a policy that only allows invocation from the VPC. Use IAM roles to restrict which users can invoke the endpoint.

D.Configure network ACLs on the VPC subnet to allow only the endpoint's security group.

AnswerC

VPC endpoint with policy ensures only traffic from the VPC can reach SageMaker API, and IAM controls user permissions.

Why this answer

It combines a VPC endpoint for SageMaker with an IAM policy to restrict invocation to authorized users and traffic originating from the specified VPC. A VPC endpoint (interface endpoint) uses AWS PrivateLink to allow private connectivity between the VPC and SageMaker without traversing the public internet, and attaching a resource-based policy to the endpoint ensures only requests from within the VPC are accepted. IAM roles then enforce user-level authorization, meeting both the VPC-only and IAM access control requirements.

Exam trap

The trap here is that candidates may confuse network-level controls (NACLs, security groups) with service-level access control (IAM and VPC endpoints), or assume that API Gateway is required to restrict VPC access, when SageMaker's native VPC endpoint with IAM policies directly satisfies the requirement without additional services.

How to eliminate wrong answers

Option A is wrong because AWS CloudFront is a content delivery network (CDN) that caches and distributes content at edge locations; it cannot front a SageMaker endpoint directly, and IP-based restrictions in CloudFront do not enforce VPC-origin traffic or integrate with SageMaker invocation. Option B is wrong because API Gateway in front of a SageMaker endpoint adds unnecessary latency and complexity, and its resource policies control API Gateway access, not SageMaker endpoint invocation; the requirement is to restrict the SageMaker endpoint itself, not to proxy through API Gateway. Option D is wrong because network ACLs (NACLs) are stateless firewalls that control traffic at the subnet level, but they cannot restrict invocation of a specific SageMaker endpoint; they also cannot enforce IAM-based authorization or ensure that only authorized users invoke the endpoint.

Practice this question →

312

MCQhard

A company is using Amazon SageMaker to train a model with a custom algorithm. The training script reads data from an S3 bucket using boto3. The training job fails with an 'AccessDenied' error when trying to access the S3 bucket. The IAM role attached to the SageMaker notebook instance has full S3 access. What is the most likely cause?

A.The S3 bucket has a bucket policy that denies access from the SageMaker service.

B.The SageMaker execution role used for the training job does not have S3 access permissions.

C.The training script is using an incorrect S3 bucket name.

D.The SageMaker training job is not configured to use the S3 VPC endpoint.

AnswerB

The training job uses its own execution role, which must be granted S3 access.

Why this answer

The IAM role attached to the SageMaker notebook instance is used for interactive development, but training jobs run under a separate SageMaker execution role. Even if the notebook role has full S3 access, the training job's execution role must also have explicit S3 permissions. The 'AccessDenied' error indicates that the execution role lacks the necessary s3:GetObject or s3:ListBucket actions for the S3 bucket.

Exam trap

The trap here is that candidates confuse the IAM role attached to the SageMaker notebook instance with the execution role used by the training job, assuming they are the same or that permissions propagate automatically.

How to eliminate wrong answers

Option A is wrong because a bucket policy that denies SageMaker access would typically produce a different error (e.g., 'AccessDenied' with a specific denial message), and the question states the role has full S3 access, so a bucket policy conflict is less likely than a missing execution role permission. Option C is wrong because an incorrect bucket name would result in a 'NoSuchBucket' or '404' error, not an 'AccessDenied' error. Option D is wrong because a missing S3 VPC endpoint would cause a network timeout or connectivity error, not an IAM permission error, and SageMaker can access S3 over the public internet by default.

Practice this question →

313

MCQhard

A SageMaker endpoint has a CloudWatch alarm configured as shown in the exhibit. The alarm fires when the p99 latency exceeds 500 ms for two consecutive minutes. Which action should the data scientist take to reduce latency?

A.Increase the number of instances behind the endpoint

B.Increase the batch size in the inference request

C.Use SageMaker asynchronous inference instead of real-time

D.Switch to GPU instances even if the model does not require GPU

AnswerA

More instances distribute load, reducing latency.

Why this answer

Increasing the number of instances behind the endpoint adds more compute capacity to handle the inference requests, which directly reduces the queuing and processing time for each request. Since the alarm triggers when p99 latency exceeds 500 ms for two consecutive minutes, scaling out horizontally distributes the load and lowers tail latency.

Exam trap

The trap here is that candidates may confuse latency reduction with throughput improvements, and incorrectly choose batch size increase or GPU switching, not realizing that scaling out is the direct remedy for high tail latency under sustained load.

How to eliminate wrong answers

Option B is wrong because increasing the batch size in the inference request would actually increase the processing time per request, potentially worsening latency rather than reducing it. Option C is wrong because SageMaker asynchronous inference is designed for large payloads and long processing times, not for reducing latency—it introduces additional queuing and storage overhead. Option D is wrong because switching to GPU instances when the model does not require GPU adds unnecessary cost and may not improve latency; GPU instances are beneficial only for models that can leverage parallel computation, and using them without need can even increase latency due to overhead.

Practice this question →

314

MCQhard

A data scientist is using SageMaker Autopilot to automatically build a classification model. The dataset is highly imbalanced (1% positive class). Which configuration should the scientist set to handle the class imbalance?

A.Set the problem_type to 'BinaryClassification' and enable 'balance_class_weights'.

B.Use the 'AutoMLJobObjective' with 'F1' metric.

C.Set the 'sample_weight' attribute in the input data.

D.Manually downsample the majority class before training.

AnswerB

Optimizing for F1 helps address class imbalance by balancing precision and recall.

Why this answer

SageMaker Autopilot does not support direct class weighting or sample weights for imbalanced datasets. By setting the objective metric to 'F1', Autopilot will optimize the model for the harmonic mean of precision and recall, which is more robust to class imbalance than accuracy. This encourages the model to pay attention to the minority (positive) class during training and hyperparameter tuning.

Exam trap

The trap here is that candidates assume SageMaker Autopilot supports common imbalance-handling techniques like class weighting or sample weights, but in reality, the only built-in way to influence Autopilot's handling of imbalance is via the objective metric, specifically F1 or other recall-focused metrics.

How to eliminate wrong answers

Option A is wrong because SageMaker Autopilot does not have a 'balance_class_weights' parameter; class weighting is not a configurable option in Autopilot's API. Option C is wrong because SageMaker Autopilot does not accept a 'sample_weight' attribute in the input data; it only supports tabular data without per-sample weight columns. Option D is wrong because manually downsampling the majority class is an external preprocessing step that contradicts Autopilot's goal of fully automated model building and may discard valuable data, reducing overall model performance.

Practice this question →

315

MCQeasy

A SageMaker endpoint configuration is shown in the exhibit. The company wants to deploy the model to a real-time endpoint. What is missing from this configuration to successfully create the endpoint?

A.The model name is missing

B.The endpoint name is not specified in the configuration

C.The initial instance count is missing

D.The accelerator type is missing

E.The data capture configuration is missing

AnswerB

Endpoint name is provided when creating the endpoint, not in the config.

Why this answer

The endpoint configuration must include an EndpointName parameter to uniquely identify the endpoint within the AWS account and region. Without it, the CreateEndpoint API call fails because the service cannot route traffic or manage the deployment. The exhibit shows a valid EndpointConfigName, but the endpoint itself is not named, which is a required field for real-time inference endpoints.

Exam trap

The trap here is that candidates often confuse the EndpointConfigName (which is present) with the EndpointName, assuming the configuration itself names the endpoint, but AWS requires an explicit separate EndpointName parameter in the CreateEndpoint call.

How to eliminate wrong answers

Option A is wrong because the model name is specified in the ModelName field within the ProductionVariants list, so it is not missing. Option C is wrong because the initial instance count is provided as InitialInstanceCount=1 in the ProductionVariants, satisfying the requirement. Option D is wrong because the accelerator type is optional; it is only needed if you want to use Elastic Inference, but it is not required for a basic endpoint creation.

Option E is wrong because data capture configuration is optional and only used for monitoring or auditing; it is not a prerequisite for deploying a real-time endpoint.

Practice this question →

316

MCQhard

An engineer runs the AWS CLI command in the exhibit to create a SageMaker endpoint configuration. The endpoint is created successfully, but when invoked, the inference response is slow. The engineer wants to test with a different instance type. Which action should the engineer take?

A.Create a new endpoint configuration and use it to create a new endpoint

B.Modify the existing endpoint directly using the update-endpoint API with a new instance type parameter

C.Delete the endpoint and create a new one with the desired instance type

D.Update the endpoint configuration with the new instance type and then update the endpoint

AnswerD

You can update the endpoint configuration and then call update-endpoint to apply changes.

Why this answer

To change the instance type for an existing SageMaker endpoint, you must first update the endpoint configuration with the new instance type, then update the endpoint to use the updated configuration. Option D describes this correct procedure. Option B is incorrect because the update-endpoint API does not directly accept an instance type parameter; it updates the endpoint to use a new endpoint configuration.

Option A creates a new endpoint, which is less efficient. Option C deletes the endpoint unnecessarily.

Practice this question →

317

MCQhard

A company is using Amazon SageMaker to train a large natural language processing model. The training job uses a GPU instance and is expected to take several hours. The data scientist wants to monitor GPU utilization in real-time. Which approach is MOST effective?

A.Use SageMaker Managed Spot Training to reduce cost and monitor utilization via spot instance status

B.Modify the training script to periodically log GPU utilization to a file in S3

C.Use SageMaker Debugger to capture GPU utilization tensors

D.Enable CloudWatch metrics for the training job and view GPU utilization in the CloudWatch console

AnswerD

SageMaker automatically publishes GPU metrics to CloudWatch.

Why this answer

Amazon SageMaker automatically publishes GPU utilization metrics (e.g., `GPUUtilization`, `GPUMemoryUtilization`) to Amazon CloudWatch for training jobs running on GPU instances. By enabling CloudWatch metrics (which is the default behavior for SageMaker training jobs), the data scientist can view real-time GPU utilization directly in the CloudWatch console without any code modifications. This is the most effective approach because it requires no changes to the training script and provides native, real-time monitoring.

Exam trap

The trap here is that candidates confuse SageMaker Debugger’s ability to capture tensors (which are model-internal data) with hardware monitoring metrics, leading them to choose C, when in fact CloudWatch is the correct service for infrastructure-level monitoring.

How to eliminate wrong answers

Option A is wrong because Managed Spot Training is a cost-saving mechanism that uses spare EC2 capacity, not a monitoring tool; spot instance status only indicates interruption risk, not GPU utilization. Option B is wrong because periodically logging to S3 introduces latency and is not real-time; it also requires modifying the training script, which is less efficient than using built-in CloudWatch metrics. Option C is wrong because SageMaker Debugger is designed to capture tensors and debug model training (e.g., gradients, weights), not to monitor hardware utilization like GPU usage; it does not emit GPU utilization metrics to CloudWatch.

Practice this question →

318

MCQmedium

A company is deploying a real-time inference endpoint using Amazon SageMaker. The model is a large deep learning model that requires low latency. The team is concerned about cost. Which SageMaker hosting option should the team use?

A.Use a SageMaker batch transform job.

B.Use a SageMaker Serverless Inference endpoint.

C.Use a single-instance endpoint with a large instance type.

D.Use a SageMaker multi-model endpoint.

AnswerD

Multi-model endpoints share resources and reduce cost per model.

Why this answer

A SageMaker multi-model endpoint allows you to host multiple models on a single endpoint behind the same serving container, sharing resources and reducing costs while still providing low-latency real-time inference. This is ideal for a large deep learning model that needs low latency but must be cost-effective, as it avoids the expense of dedicated instances for each model.

Exam trap

The trap here is that candidates often confuse 'low latency' with 'dedicated resources' and choose a single-instance endpoint (Option C), overlooking that multi-model endpoints can achieve low latency through caching and shared infrastructure while significantly reducing cost.

How to eliminate wrong answers

Option A is wrong because SageMaker batch transform jobs are designed for offline, asynchronous inference on large datasets, not for real-time inference with low latency. Option B is wrong because SageMaker Serverless Inference endpoints automatically scale to zero when idle, but they can introduce cold start latency that violates the low-latency requirement for a large deep learning model. Option C is wrong because using a single-instance endpoint with a large instance type may provide low latency but is not cost-effective, as it dedicates expensive resources to a single model without sharing, leading to higher costs.

Practice this question →

319

MCQeasy

An ML team wants to perform batch inference on a large dataset stored in Amazon S3 using a pre-trained model. The team needs to process the data in parallel across multiple instances to reduce processing time. Which approach should they use?

A.Use SageMaker Processing to run a custom inference script.

B.Use SageMaker Batch Transform with multiple instances.

C.Use SageMaker Training to run inference as a training job.

D.Use SageMaker Ground Truth to process the data.

AnswerB

Batch Transform splits the input data and runs inference in parallel.

Why this answer

SageMaker Batch Transform is designed specifically for batch inference on large datasets stored in Amazon S3. It automatically distributes the data across multiple instances, processes them in parallel, and writes the results back to S3, making it the optimal choice for reducing processing time.

Exam trap

The trap here is that candidates often confuse SageMaker Processing (which sounds like it could handle inference) with Batch Transform, but Processing is strictly for data transformation, not model inference.

How to eliminate wrong answers

Option A is wrong because SageMaker Processing is intended for data preprocessing, feature engineering, and validation tasks, not for running inference with a pre-trained model. Option C is wrong because SageMaker Training is designed for model training, not inference; using it for inference would be inefficient and misuse the service. Option D is wrong because SageMaker Ground Truth is a data labeling service for creating training datasets, not for batch inference.

Practice this question →

320

MCQmedium

A team uses SageMaker to train a deep learning model. They notice the training job is using only a fraction of the GPU memory. Which configuration change would most improve GPU utilization?

A.Increase the batch size in the training script

B.Decrease the batch size to reduce memory fragmentation

C.Use a single GPU instead of multiple GPUs

D.Enable SageMaker Managed Spot Training

AnswerA

Larger batch sizes consume more GPU memory and improve utilization.

Why this answer

Increasing the batch size allows each training step to process more data samples simultaneously, which increases the computational load per step and better saturates the GPU's parallel processing units. This directly improves GPU memory utilization because larger batches keep more tensors resident in memory and increase the arithmetic intensity of matrix operations, reducing idle time.

Exam trap

The trap here is that candidates confuse memory fragmentation (which is a memory allocation issue) with overall utilization, and incorrectly assume reducing batch size will fix fragmentation when the real problem is underutilization due to insufficient computational load.

How to eliminate wrong answers

Option B is wrong because decreasing the batch size reduces the amount of data processed per step, which actually lowers GPU utilization by leaving memory underfilled and increasing the frequency of kernel launches relative to computation. Option C is wrong because using a single GPU instead of multiple GPUs does not address low per-GPU memory utilization; it may even worsen the problem by removing the opportunity to distribute batches across devices. Option D is wrong because SageMaker Managed Spot Training only affects cost and instance availability by using preemptible EC2 Spot instances; it has no impact on GPU memory utilization or training script configuration.

Practice this question →

321

MCQeasy

A data scientist needs to run a one-time SQL query on a large dataset in S3 to create a training dataset. The query involves aggregations and joins. Which service is most suitable?

A.AWS Glue ETL job

B.Amazon Athena

C.Amazon EMR with Spark SQL

D.Amazon RDS with data loaded into it

AnswerB

Amazon Athena is serverless and optimized for querying data in S3 using standard SQL, making it suitable for this use case.

Why this answer

Amazon Athena is the correct choice because it is a serverless service that allows running SQL queries directly on data stored in S3, ideal for one-time ad-hoc queries with aggregations and joins. Option A (AWS Glue ETL) is designed for scheduled ETL jobs, not ad-hoc queries. Option C (Amazon EMR with Spark SQL) provides powerful processing but is overkill and requires cluster management.

Option D (Amazon RDS) would require moving data into a database, which is inefficient.

Practice this question →

322

MCQmedium

A data scientist uses SageMaker to train a model. The training job takes 10 hours, but the team needs to reduce costs. Which approach is MOST cost-effective?

A.Enable Managed Spot Training

B.Use SageMaker Automatic Model Tuning

C.Use a larger instance type to finish faster

D.Use SageMaker Distributed Training with more instances

AnswerA

Spot instances offer significant discounts, reducing cost.

Why this answer

Managed Spot Training leverages Amazon EC2 Spot Instances, which offer spare compute capacity at up to 90% discount compared to On-Demand instances. This makes it the most cost-effective approach for reducing training costs. Option A is correct.

Option B (using Automatic Model Tuning) is designed for hyperparameter optimization, not cost reduction, and may increase cost due to additional training jobs. Option C (using a larger instance type) finishes faster but at a higher per-hour cost, potentially increasing total cost. Option D (using Distributed Training with more instances) increases resource usage and cost, though it may reduce training time.

Practice this question →

323

MCQeasy

A team is using Amazon SageMaker to train a linear regression model on a dataset with 10 features. After training, they notice the model has high bias. Which action is MOST likely to reduce bias?

A.Increase the regularization parameter lambda

B.Add L2 regularization

C.Use a smaller training dataset

D.Add polynomial features to capture non-linear relationships

AnswerD

Adding features increases model complexity, reducing bias.

Why this answer

High bias indicates underfitting, which can be reduced by adding more features or increasing model complexity. Option A reduces risk of overfitting, not bias. Option B increases regularization, which increases bias.

Option C reduces data, potentially increasing bias.

Practice this question →

324

MCQhard

A company is using SageMaker Ground Truth to label images for a computer vision model. After launching the labeling job, they notice that the labeling throughput is lower than expected. What should they do to increase throughput?

A.Use a private workforce with more workers.

B.Change the labeling task to use a single annotator per image.

C.Reduce the number of workers assigned to each task.

D.Increase the time allowed for each labeling task.

AnswerA

More workers increase labeling parallelism and throughput.

Why this answer

SageMaker Ground Truth labeling throughput is primarily limited by the number of workers available to process tasks. Using a private workforce allows you to directly control and scale the number of workers, which increases parallelism and overall throughput. Public or vendor workforces have fixed capacity and may not scale as quickly, so adding more private workers is the most effective way to boost throughput.

Exam trap

The trap here is that candidates confuse throughput with quality or accuracy, thinking that reducing workers or increasing time will improve speed, when in fact throughput is a direct function of parallel worker capacity.

How to eliminate wrong answers

Option B is wrong because using a single annotator per image reduces parallelism and can actually decrease throughput, as each image must wait for one worker to complete it before moving to the next. Option C is wrong because reducing the number of workers assigned to each task decreases parallelism, which lowers throughput rather than increasing it. Option D is wrong because increasing the time allowed for each labeling task does not change the rate at which tasks are completed; it only extends the deadline, which can reduce throughput by allowing workers to take longer per task.

Practice this question →

325

MCQmedium

A team is training a large language model using PyTorch on multiple GPUs. The training is taking too long due to inefficient data loading. Which AWS service can help accelerate data loading by caching data close to the GPU instances?

A.Amazon FSx for Lustre

B.Amazon EBS Snapshots for fast restore

C.Amazon S3 Transfer Acceleration

D.Amazon CloudFront

AnswerA

High-performance file system with sub-millisecond latency.

Why this answer

Amazon FSx for Lustre is a high-performance file system optimized for machine learning workloads. It provides sub-millisecond latencies and high throughput by caching training data on local NVMe SSDs attached to the Lustre servers, which are co-located with GPU instances in the same AWS Availability Zone. This eliminates the I/O bottleneck from remote object storage, directly accelerating data loading for PyTorch DataLoader workers.

Exam trap

The trap here is that candidates confuse 'caching data close to compute' with general-purpose CDN or acceleration services, failing to recognize that Amazon FSx for Lustre is the only option designed for high-throughput, low-latency file system access in a GPU cluster environment on AWS.

How to eliminate wrong answers

Option B is wrong because Amazon EBS Snapshots for fast restore is a feature for restoring EBS volumes from snapshots with reduced latency, not a caching layer for active training data; it does not accelerate data loading during training. Option C is wrong because Amazon S3 Transfer Acceleration speeds up uploads to S3 over long distances using edge locations, but it does not cache data near GPU instances for repeated reads during training. Option D is wrong because Amazon CloudFront is a content delivery network (CDN) for caching static web content at edge locations, not for low-latency file access in a GPU cluster; it is designed for HTTP-based delivery, not POSIX-compliant file I/O required by PyTorch.

Practice this question →

326

MCQeasy

A company wants to use Amazon Rekognition to detect objects in images stored in an S3 bucket. The images are uploaded by users. Which IAM policy statement is necessary to allow Rekognition to read from the bucket?

A.s3:PutObject

B.s3:DeleteObject

C.s3:GetObject

D.s3:ListBucket

AnswerC

GetObject allows Rekognition to read images.

Why this answer

Amazon Rekognition needs to read the image files from the S3 bucket to perform object detection. The s3:GetObject permission grants read access to the objects stored in the bucket, which is the minimum required action for Rekognition to retrieve and analyze the images.

Exam trap

The trap here is that candidates often confuse s3:ListBucket with read access, but listing only returns object keys, not the actual data, so Rekognition cannot analyze the image without s3:GetObject.

How to eliminate wrong answers

Option A is wrong because s3:PutObject allows writing (uploading) objects to the bucket, not reading them; Rekognition does not need to write images. Option B is wrong because s3:DeleteObject allows deleting objects, which is irrelevant for reading and analyzing images. Option D is wrong because s3:ListBucket allows listing the objects in the bucket but does not grant permission to read the actual object content; Rekognition must retrieve the object data, not just enumerate keys.

Practice this question →

327

MCQhard

A company uses Amazon SageMaker to train machine learning models. The data science team has developed a training script that uses TensorFlow. They want to run the training job on a GPU instance (ml.p3.2xlarge) and store the model artifact in Amazon S3. The training job completes successfully, but the model artifact is not saved to S3. The team has confirmed that the S3 bucket policy allows write access from the SageMaker execution role. The training script uses the TensorFlow estimator with the following configuration: ``` tensorflow_estimator = TensorFlow( entry_point='train.py', role='arn:aws:iam::123456789012:role/SageMakerExecutionRole', instance_count=1, instance_type='ml.p3.2xlarge', output_path='s3://my-bucket/output', framework_version='2.3', py_version='py37', ) ``` The train.py script saves the model using `model.save('/opt/ml/model')`. What is the MOST likely reason the model artifact is not being saved to S3?

A.The training script must save the model to /opt/ml/model/saved_model instead of /opt/ml/model.

B.The SageMaker execution role does not have the s3:PutObject permission for the S3 bucket.

C.The output_path parameter is incorrectly formatted; it should include a trailing slash.

D.The TensorFlow estimator requires the model_dir parameter to be set to the S3 output path.

AnswerB

Correct: The role needs s3:PutObject to write to S3.

Why this answer

The training script correctly saves the model to /opt/ml/model, which is the default directory that SageMaker automatically uploads to the S3 output path at the end of training. Since the job completes successfully, the script ran without errors. The most likely cause is that the SageMaker execution role lacks the s3:PutObject permission on the S3 bucket.

Although the bucket policy allows write access from the role, the role itself must have the appropriate IAM permission. Option B is correct. Option A is incorrect because saving to /opt/ml/model is correct.

Option C is incorrect because output_path does not require a trailing slash and is correctly formatted. Option D is incorrect because TensorFlow estimator does not have a model_dir parameter that overrides the default; the default is /opt/ml/model.

Practice this question →

328

MCQhard

A team wants to automate the retraining of a model weekly using new data that arrives in S3. Which combination of services should they use?

A.AWS Lambda and S3 events

B.Amazon SageMaker Processing jobs

C.AWS Step Functions and AWS Glue

D.Amazon SageMaker Pipelines and S3 events

AnswerD

SageMaker Pipelines is designed for ML workflows and can be triggered by S3 events.

Why this answer

Amazon SageMaker Pipelines natively supports automated retraining workflows triggered by S3 events. When new data arrives in S3, an event notification can invoke a Lambda function that starts a pipeline execution, which includes steps for data processing, training, evaluation, and model registration. This provides a fully managed, repeatable, and auditable MLOps pipeline without custom orchestration code.

Exam trap

The trap here is that candidates often confuse event-driven triggers (Lambda + S3 events) with the need for a full MLOps pipeline, overlooking that SageMaker Pipelines provides the orchestration, model registry integration, and step-level caching that Lambda alone cannot offer.

How to eliminate wrong answers

Option A is wrong because AWS Lambda and S3 events alone can trigger a function on new data, but they lack built-in orchestration for multi-step retraining workflows like data validation, hyperparameter tuning, and model registration. Option B is wrong because Amazon SageMaker Processing jobs are single-step data processing tasks; they do not provide end-to-end pipeline orchestration or event-driven scheduling for weekly retraining. Option C is wrong because AWS Step Functions and AWS Glue can orchestrate workflows, but Glue is primarily for ETL and not optimized for SageMaker training jobs; this combination requires custom integration and lacks the native SageMaker pipeline capabilities for model versioning and deployment.

Practice this question →

329

Multi-Selectmedium

A data scientist is training a model using Amazon SageMaker and wants to reduce the training time. The training job uses a single GPU instance. Which THREE actions can reduce training time?

Select 3 answers

A.Use distributed training across multiple GPU instances.

B.Use Pipe input mode instead of File input mode.

C.Use a larger instance type with more GPU memory and compute.

D.Increase the amount of training data.

E.Reduce the batch size.

AnswersA, B, C

Distributed training parallelizes the workload.

Why this answer

Options A, B, and C are correct. Distributed training across multiple GPU instances (A) leverages parallelism to reduce training time. Pipe input mode (B) streams data directly from S3, reducing I/O wait time compared to File mode which downloads data first.

Using a larger instance type with more GPU memory and compute (C) provides more processing power, allowing faster training. Option D is incorrect because increasing the amount of training data typically increases training time, not reduces it. Option E is incorrect because reducing batch size can lead to more iterations and longer training time, though it may sometimes affect convergence.

Practice this question →

330

MCQmedium

Refer to the exhibit. A company is using an IAM role with the attached policy to deploy a SageMaker model. The data scientist can create training jobs and models, but when trying to create an endpoint, they receive an access denied error. What is the missing permission?

A.cloudwatch:PutMetricData

B.iam:PassRole

C.ec2:CreateNetworkInterface

D.sagemaker:InvokeEndpoint

E.kms:Decrypt

AnswerC

SageMaker creates an ENI in the VPC for the endpoint.

Why this answer

When SageMaker creates an endpoint, it provisions a network interface in the customer's VPC to route traffic to the endpoint instances. The IAM role must have the ec2:CreateNetworkInterface permission to allow SageMaker to create this ENI; without it, the endpoint creation fails with an access denied error.

Exam trap

The trap here is that candidates confuse the permissions needed for training jobs (which often require iam:PassRole) with those needed for endpoints, overlooking the VPC networking requirement that is specific to endpoint creation.

How to eliminate wrong answers

Option A is wrong because cloudwatch:PutMetricData is used to publish custom metrics to CloudWatch, but SageMaker automatically sends endpoint metrics without requiring this permission in the role. Option B is wrong because iam:PassRole is needed to allow SageMaker to assume a role, but the question states the role is already attached and training jobs work, so PassRole is not the missing permission. Option D is wrong because sagemaker:InvokeEndpoint is an action for invoking a deployed endpoint for inference, not for creating the endpoint itself.

Option E is wrong because kms:Decrypt is only relevant if the endpoint uses customer-managed KMS keys for encryption, and the error occurs even without KMS encryption configured.

Practice this question →

331

Multi-Selectmedium

A data science team is deploying a machine learning model using Amazon SageMaker. The model requires GPU inference and must handle variable traffic with low latency. Which TWO options should the team implement to meet these requirements? (Choose TWO.)

Select 2 answers

A.Use a SageMaker multi-model endpoint with a GPU instance to serve multiple models.

B.Deploy to a SageMaker real-time endpoint using a CPU instance and attach an Elastic Inference accelerator.

C.Use AWS Lambda with an attached GPU function for inference.

D.Host the model on a SageMaker batch transform job with GPU instances.

E.Deploy the model to a SageMaker real-time endpoint using a GPU instance type.

AnswersA, E

Correct: Multi-model endpoint on GPU provides GPU inference and efficient resource utilization for variable traffic.

Why this answer

A is correct because a SageMaker multi-model endpoint with a GPU instance allows you to host multiple models on a single endpoint, dynamically loading and unloading them based on traffic, while providing GPU acceleration for low-latency inference. This approach efficiently handles variable traffic patterns by scaling the endpoint and leveraging GPU compute for deep learning models.

Exam trap

The trap here is that candidates may confuse multi-model endpoints with batch transform jobs or think that Elastic Inference can substitute for a full GPU instance, but the question specifically requires GPU inference and low latency, which only GPU instances or multi-model endpoints with GPU instances can reliably provide.

Practice this question →

332

MCQmedium

A data scientist is using Amazon SageMaker to train a model on a large dataset (10 TB) stored in S3 in Parquet format. The training job uses an ml.p3.16xlarge instance with multiple GPUs. The data scientist notices that the GPU utilization is low (around 30%) and the training is slow. The dataset consists of hundreds of thousands of small Parquet files. The data scientist suspects that the I/O is bottlenecked. What should the data scientist do to improve GPU utilization and training speed?

A.Increase the batch size

B.Consolidate the small Parquet files into larger files (e.g., 1 GB each)

C.Use a smaller instance type to reduce cost

D.Use Pipe input mode to stream data directly

AnswerB

Larger files reduce I/O overhead.

Why this answer

Consolidating small Parquet files into larger files (e.g., 1 GB each) reduces the overhead of reading many small files from S3, improving I/O throughput and keeping GPUs busy. Option A (increase batch size) may help GPU utilization but does not address the I/O bottleneck. Option C (use a smaller instance) would not improve speed and may worsen the situation.

Option D (Pipe input mode) can help with streaming but does not solve the small file issue; the data still comes from many small files.

Practice this question →

333

MCQeasy

A data scientist is using AWS Glue to prepare training data. The job reads from an S3 bucket, performs transformations, and writes to another S3 bucket. The job is failing due to insufficient memory. Which solution should the data scientist use to fix this?

A.Use AWS Glue's job bookmark feature.

B.Increase the number of DPU (Data Processing Units) for the job.

C.Use Amazon Athena instead of AWS Glue.

D.Use a columnar file format like Parquet.

AnswerB

More workers provide more memory.

Why this answer

The job is failing due to insufficient memory, which is a resource constraint. Increasing the number of DPU (Data Processing Units) allocates more memory and compute capacity to the AWS Glue job, directly addressing the out-of-memory error. This is the standard approach to scale Glue ETL jobs when they hit memory limits.

Exam trap

The trap here is that candidates confuse performance optimization techniques (like using columnar formats or job bookmarks) with resource scaling, assuming any 'best practice' will fix a memory error, when the direct solution is to increase compute/memory allocation via DPUs.

How to eliminate wrong answers

Option A is wrong because AWS Glue job bookmarks are used for incremental processing and tracking previously processed data, not for resolving memory or resource constraints. Option C is wrong because Amazon Athena is a serverless query service for ad-hoc SQL analysis, not a replacement for Glue ETL jobs that require custom transformations and writing to S3; switching to Athena would not fix a memory issue in a Glue job. Option D is wrong because using a columnar file format like Parquet can improve compression and query performance, but it does not increase the memory available to the Glue job; the job still runs with the same DPU allocation.

Practice this question →

334

MCQmedium

A data scientist has this IAM policy attached to their IAM role. They are trying to run a SageMaker training job that reads data from 'my-bucket' and writes output to 'my-bucket'. The job fails. What is the most likely reason?

A.The sagemaker:CreateTrainingJob action is not allowed on specific resources

B.Missing s3:ListBucket permission on the bucket

C.Missing iam:PassRole permission

D.The training job requires permissions to write to CloudWatch Logs

AnswerC

SageMaker needs permission to pass the execution role to the training job.

Why this answer

The most likely reason the SageMaker training job fails is that the IAM role lacks the `iam:PassRole` permission. When SageMaker creates a training job, it must assume the execution role specified in the request; without `iam:PassRole`, the service cannot pass the role to itself, causing the API call to fail. This is a common prerequisite for any SageMaker job that requires an execution role.

Exam trap

The trap here is that candidates often focus on S3 permissions (like ListBucket) or assume the training job needs CloudWatch Logs, but the real blocker is the missing `iam:PassRole` permission, which is a common oversight when configuring IAM policies for SageMaker.

How to eliminate wrong answers

Option A is wrong because the policy explicitly allows `sagemaker:CreateTrainingJob` on all resources (`"*"`), so there is no resource-level restriction. Option B is wrong because the policy includes `s3:GetObject` and `s3:PutObject` on `my-bucket`, and while `s3:ListBucket` is missing, SageMaker training jobs do not require ListBucket permission to read or write objects; they only need GetObject and PutObject. Option D is wrong because the policy does not include CloudWatch Logs permissions, but the question states the job fails when reading/writing to S3, and CloudWatch Logs permissions are not required for S3 access; the failure is more directly tied to the missing PassRole.

Practice this question →

335

MCQmedium

A machine learning engineer is building a pipeline using Amazon SageMaker Pipelines. The pipeline has multiple steps including data preprocessing, training, and evaluation. Which statement about SageMaker Pipelines is correct?

A.Steps in a pipeline must run sequentially.

B.Pipelines support caching of step outputs.

C.Pipelines can only use built-in algorithms.

D.Pipelines cannot have conditional branches.

AnswerB

Caching speeds up re-runs.

Why this answer

SageMaker Pipelines supports output caching, which allows step outputs to be reused when the step configuration and inputs remain unchanged. This caching mechanism reduces execution time and cost by skipping redundant computations for steps like data preprocessing or training when their parameters have not changed.

Exam trap

The trap here is that candidates often assume pipelines are strictly sequential (like traditional scripts) and overlook SageMaker's support for parallelism, custom code, and conditional logic, leading them to select option A or D.

How to eliminate wrong answers

Option A is wrong because SageMaker Pipelines supports parallel execution of independent steps, not strictly sequential execution. Option C is wrong because pipelines can use custom algorithms, scripts, and containers in addition to built-in algorithms. Option D is wrong because SageMaker Pipelines supports conditional branching via the `ConditionStep`, allowing different execution paths based on evaluation metrics or other criteria.

Practice this question →

336

MCQeasy

A machine learning engineer is building a pipeline to preprocess data and train a model using Amazon SageMaker. The data is stored in Amazon S3 and the preprocessing step is computationally intensive. The engineer wants to minimize costs while ensuring that the preprocessing step does not fail due to instance termination. Which instance type should be used for the preprocessing step?

A.Reserved instances

B.On-demand instances

C.A larger instance type to speed up processing

D.Spot instances

AnswerB

On-demand instances are reliable and not terminated, ensuring the step completes.

Why this answer

On-demand instances (Option B) are the correct choice because they provide reliable, non-interruptible compute capacity for the preprocessing step. Spot instances can be terminated at any time (with a 2-minute warning) when AWS reclaims capacity, which would cause the computationally intensive preprocessing to fail. Reserved instances require a 1- or 3-year commitment and are not cost-effective for a single preprocessing job that may not run continuously.

Exam trap

A common misconception in AWS is that Spot instances are always the cheapest option and should be used for all cost-sensitive workloads, ignoring the risk of interruption for non-fault-tolerant preprocessing steps.

How to eliminate wrong answers

Option A is wrong because Reserved instances require a long-term commitment (1 or 3 years) and are designed for steady-state workloads, not for a single preprocessing job where you want to minimize costs without upfront payment. Option C is wrong because using a larger instance type may speed up processing but does not address the core requirement of preventing failure due to instance termination; it also increases cost per hour. Option D is wrong because Spot instances can be reclaimed by AWS with a 2-minute termination notice when capacity is needed elsewhere, making them unsuitable for a computationally intensive preprocessing step that must not fail due to interruption.

Practice this question →

337

Drag & Dropmedium

Drag and drop the steps to train a model using Amazon SageMaker built-in algorithm in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Training involves data preparation, job creation, algorithm selection, input/output paths, and execution.

Practice this question →

338

MCQhard

A data scientist is using Amazon SageMaker to train a TensorFlow model on a dataset that includes sensitive personal information (PII). The data is stored in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The training job fails with an Access Denied error when trying to read from S3. The data scientist has already verified that the SageMaker execution role has s3:GetObject permissions on the S3 bucket. What additional configuration is needed?

A.Add kms:Decrypt permission to the SageMaker execution role.

B.Add kms:Encrypt permission to the SageMaker execution role.

C.Add a bucket policy that grants s3:GetObject to the SageMaker role.

D.Configure a VPC endpoint for S3 and attach a policy.

AnswerA

SSE-KMS requires decrypt permission to read objects.

Why this answer

When S3 objects are encrypted with SSE-KMS, the SageMaker execution role must have the kms:Decrypt permission to decrypt the data during training. Even though the role has s3:GetObject access, the KMS key policy or the role's IAM policy must explicitly allow decryption of the KMS key used for server-side encryption. Without this, SageMaker cannot read the encrypted objects, resulting in an Access Denied error.

Exam trap

The trap here is that candidates often focus solely on S3 permissions and overlook the fact that SSE-KMS introduces a separate KMS authorization layer, so even with full S3 access, the role still needs explicit kms:Decrypt to read encrypted objects.

How to eliminate wrong answers

Option B is wrong because kms:Encrypt is used for writing or uploading encrypted data, not for reading; the training job only needs to decrypt the existing data. Option C is wrong because the data scientist has already verified that s3:GetObject permissions are in place, so adding another bucket policy for the same action is redundant and does not address the KMS encryption requirement. Option D is wrong because a VPC endpoint for S3 is used to route traffic privately within a VPC, but it does not grant KMS decryption permissions; the Access Denied error stems from missing KMS permissions, not network connectivity.

Practice this question →