easyMultiple SelectObjective-mapped
MLA-C01 Practice Question: Using Amazon SageMaker to host a real-time…
A company is using Amazon SageMaker to host a real-time inference endpoint. They want to restrict access to the endpoint to only a specific VPC and require authentication using AWS IAM. Which TWO configuration steps should they take to achieve this? (Choose TWO.)
⚠ Common exam trap
Candidates often confuse resource-based policies (like S3 bucket policies) with SageMaker endpoint capabilities, or assume that a security group alone can enforce VPC-only access, when in fact SageMaker requires explicit VPC configuration via PrivateLink or subnet placement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the endpoint to be deployed in a private subnet within the VPC
Deploying the SageMaker endpoint in a private subnet within the VPC ensures that the endpoint is not publicly accessible and can only be reached from within that VPC. This is achieved by using a VPC interface endpoint (AWS PrivateLink) or by placing the endpoint directly in the VPC, which restricts network traffic to the VPC boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the endpoint to be deployed in a private subnet within the VPC
Why this is correct
Private subnet restricts traffic to within the VPC.
- ✓
Enable IAM-based authentication for the endpoint
Why this is correct
IAM auth ensures only authorized users can invoke the endpoint.
- ✗
Attach a resource-based policy to the endpoint that denies all traffic except from the VPC
Why it's wrong here
SageMaker endpoints use IAM policies, not resource-based policies.
- ✗
Place the endpoint behind Amazon CloudFront to act as a proxy
Why it's wrong here
CloudFront does not replace IAM auth for SageMaker endpoints.
- ✗
Use a public subnet and configure a security group to allow only the company's IP range
Why it's wrong here
Public subnet exposes the endpoint to the internet, though IP filtering adds some security.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 835 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.