hardMultiple SelectObjective-mapped
MLA-C01 Practice Question: A company has deployed a model to a SageMaker…
A company has deployed a model to a SageMaker endpoint. The security team wants to ensure that all traffic between the endpoint and the client application is encrypted and that the endpoint is not accessible from the internet. Which TWO actions should the company take? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently confuse encryption in transit with encryption at rest, leading them to select KMS (Option E) for data in transit, or they assume that restricting IP addresses via security groups (Option C) is sufficient to block internet access, when in fact a public endpoint remains internet-accessible regardless of security group rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the SageMaker endpoint to be VPC-only by setting the endpoint's VPC configuration.
Configuring a SageMaker endpoint as VPC-only ensures that the endpoint is not publicly accessible; it can only be reached from within the specified VPC, satisfying the security team's requirement to block internet access. Option D is correct because enabling HTTPS on the endpoint using a custom certificate from AWS Certificate Manager (ACM) encrypts all data in transit between the client and the endpoint, meeting the encryption requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the endpoint behind an API Gateway and call it from the client.
Why it's wrong here
API Gateway adds complexity and still requires VPC integration for private access.
- ✓
Configure the SageMaker endpoint to be VPC-only by setting the endpoint's VPC configuration.
Why this is correct
VPC-only endpoints are not publicly accessible.
- ✗
Create the endpoint with a public endpoint and allow only the client's IP address via security group.
Why it's wrong here
Public endpoint is still internet-facing; IP-based restrictions are not recommended.
- ✓
Enable HTTPS on the endpoint by using a custom certificate from ACM.
Why this is correct
HTTPS ensures encryption in transit.
- ✗
Use AWS KMS to encrypt data in transit between the client and the endpoint.
Why it's wrong here
KMS is for encryption at rest, not in transit; TLS/SSL is needed.
Go deeper
Related to this question
About these practice questions
One of 835 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.