← MLS-C01·Amazon Web Services

Question 1,586 of 1,755

Machine Learning Implementation and Operations →hardMultiple ChoiceObjective-mapped

MLS-C01 Practice Question: Machine Learning Implementation and Operations

This MLS-C01 practice question tests your understanding of machine learning implementation and operations. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

An ML engineer is deploying a model on a SageMaker endpoint and wants to ensure that only authorized users and services can invoke the endpoint. The company uses AWS IAM for access control and requires that the endpoint be invoked only from within a specific VPC. What combination of actions should the engineer take? (Choose the single best answer.)

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

A
Use AWS CloudFront to restrict access based on IP addresses.
Why wrong: CloudFront is for content delivery, not for SageMaker endpoint invocation.
B
Use API Gateway in front of the SageMaker endpoint and attach a resource policy to API Gateway.
Why wrong: API Gateway adds latency and complexity; not the simplest solution.
C
Create a VPC endpoint for Amazon SageMaker and attach a policy that only allows invocation from the VPC. Use IAM roles to restrict which users can invoke the endpoint.
VPC endpoint with policy ensures only traffic from the VPC can reach SageMaker API, and IAM controls user permissions.
D
Configure network ACLs on the VPC subnet to allow only the endpoint's security group.
Why wrong: Network ACLs control traffic at subnet level but do not authenticate users.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a VPC endpoint for Amazon SageMaker and attach a policy that only allows invocation from the VPC. Use IAM roles to restrict which users can invoke the endpoint.

Option C is correct because it combines a VPC endpoint for SageMaker with an IAM policy to restrict invocation to authorized users and traffic originating from the specified VPC. A VPC endpoint (interface endpoint) uses AWS PrivateLink to allow private connectivity between the VPC and SageMaker without traversing the public internet, and attaching a resource-based policy to the endpoint ensures only requests from within the VPC are accepted. IAM roles then enforce user-level authorization, meeting both the VPC-only and IAM access control requirements.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS CloudFront to restrict access based on IP addresses.
Why it's wrong here
CloudFront is for content delivery, not for SageMaker endpoint invocation.
✗
Use API Gateway in front of the SageMaker endpoint and attach a resource policy to API Gateway.
Why it's wrong here
API Gateway adds latency and complexity; not the simplest solution.
✓
Create a VPC endpoint for Amazon SageMaker and attach a policy that only allows invocation from the VPC. Use IAM roles to restrict which users can invoke the endpoint.
Why this is correct
VPC endpoint with policy ensures only traffic from the VPC can reach SageMaker API, and IAM controls user permissions.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure network ACLs on the VPC subnet to allow only the endpoint's security group.
Why it's wrong here
Network ACLs control traffic at subnet level but do not authenticate users.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may confuse network-level controls (NACLs, security groups) with service-level access control (IAM and VPC endpoints), or assume that API Gateway is required to restrict VPC access, when SageMaker's native VPC endpoint with IAM policies directly satisfies the requirement without additional services.

Detailed technical explanation

How to think about this question

A VPC endpoint for SageMaker uses AWS PrivateLink, which creates an elastic network interface (ENI) in the VPC with a private IP address, allowing SageMaker API calls (including InvokeEndpoint) to be routed through the AWS network backbone. The endpoint policy is a resource-based policy that can specify conditions like 'aws:SourceVpc' to restrict requests to a particular VPC, while IAM roles attached to users or services provide fine-grained access control via the 'sagemaker:InvokeEndpoint' action. In practice, this setup is critical for compliance with regulations like HIPAA or PCI DSS, where data must never leave a private network.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related MLS-C01 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Data Engineering practice questions

Practise MLS-C01 questions linked to Data Engineering.

Machine Learning Implementation and Operations practice questions

Practise MLS-C01 questions linked to Machine Learning Implementation and Operations.

Modeling practice questions

Practise MLS-C01 questions linked to Modeling.

Exploratory Data Analysis practice questions

Practise MLS-C01 questions linked to Exploratory Data Analysis.

MLS-C01 fundamentals practice questions

Practise MLS-C01 questions linked to MLS-C01 fundamentals.

MLS-C01 scenario practice questions

Practise MLS-C01 questions linked to MLS-C01 scenario.

MLS-C01 troubleshooting practice questions

Practise MLS-C01 questions linked to MLS-C01 troubleshooting.

Practice this exam

Start a free MLS-C01 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

MLS-C01 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this MLS-C01 question test?

Machine Learning Implementation and Operations — This question tests Machine Learning Implementation and Operations — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a VPC endpoint for Amazon SageMaker and attach a policy that only allows invocation from the VPC. Use IAM roles to restrict which users can invoke the endpoint. — Option C is correct because it combines a VPC endpoint for SageMaker with an IAM policy to restrict invocation to authorized users and traffic originating from the specified VPC. A VPC endpoint (interface endpoint) uses AWS PrivateLink to allow private connectivity between the VPC and SageMaker without traversing the public internet, and attaching a resource-based policy to the endpoint ensures only requests from within the VPC are accepted. IAM roles then enforce user-level authorization, meeting both the VPC-only and IAM access control requirements.

What should I do if I get this MLS-C01 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.