MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security
A company deploys a model for credit risk assessment on a SageMaker endpoint. To comply with internal policies, they must ensure that the endpoint only allows inference requests from within a specific VPC and that the data is encrypted at rest. Which configuration meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse network isolation (which blocks outbound internet access) with VPC-only mode (which restricts inbound traffic to a VPC), and mistaking inter-container traffic encryption for encryption at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure endpoint in VPC-only mode and enable KMS encryption for the endpoint
Configuring the SageMaker endpoint in VPC-only mode ensures that inference requests can only originate from within the specified VPC, satisfying the network restriction requirement. Enabling KMS encryption for the endpoint encrypts the model data and inference data at rest using a customer-managed key, meeting the encryption-at-rest policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable network isolation mode and use KMS for endpoint encryption
Why it's wrong here
Network isolation prevents internet access but does not restrict inference requests to VPC only.
- ✗
Configure endpoint in VPC-only mode and enable inter-container traffic encryption
Why it's wrong here
VPC-only mode restricts traffic to VPC, but inter-container encryption does not address at-rest encryption.
- ✗
Deploy endpoint in a public subnet and use a security group to restrict traffic
Why it's wrong here
Public subnet allows internet traffic; security group alone cannot enforce VPC-only access reliably.
- ✓
Configure endpoint in VPC-only mode and enable KMS encryption for the endpoint
Why this is correct
VPC-only mode restricts access to VPC; KMS encryption secures data at rest.
Go deeper
Related to this question
About these practice questions
One of 835 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.