MLS-C01 Practice Question: Machine Learning Implementation and Operations
Which TWO actions are best practices for securing a SageMaker notebook instance? (Select TWO.)
⚠ Common exam trap
Test-takers frequently confuse 'disabling direct internet access' with 'blocking all internet access' and think it will break SageMaker's ability to download libraries, not realizing that VPC endpoints or a NAT gateway can still provide controlled access to AWS services and the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable direct internet access for the notebook instance.
Disabling direct internet access for a SageMaker notebook instance (Option A) is a best practice because it prevents the instance from reaching the public internet, reducing the attack surface. This forces all outbound traffic through a VPC, allowing you to control egress via NAT gateways or VPC endpoints, and ensures data does not traverse the public internet. It is a fundamental security hardening step for sensitive workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable direct internet access for the notebook instance.
Why this is correct
Disabling internet access prevents data exfiltration.
- ✗
Enable root access for users to install packages.
Why it's wrong here
Root access should be disabled; users can use lifecycle configurations to install packages.
- ✓
Launch the notebook instance in a private subnet in a VPC.
Why this is correct
Using a private subnet with VPC provides network isolation.
- ✗
Store data in the notebook's local storage for performance.
Why it's wrong here
Data should be stored in S3 or EFS; local storage is ephemeral.
- ✗
Use a shared IAM user for all data scientists.
Why it's wrong here
Use individual IAM roles with least privilege.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.