easyMultiple SelectObjective-mapped
MLA-C01 Practice Question: A data science team is deploying a model on…
A data science team is deploying a model on Amazon SageMaker and wants to protect the endpoint from unauthorized access. Which TWO methods can the team use to secure the endpoint? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates confuse resource-based IAM policies (which are not supported for SageMaker endpoints) with identity-based policies, or they assume that attaching a security group directly to an endpoint is possible without deploying it in a VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the endpoint to be deployed within a VPC and control traffic using security groups and network ACLs.
Deploying a SageMaker endpoint within a VPC allows you to control inbound and outbound traffic using security groups and network ACLs, effectively restricting network-level access to the endpoint. This is a fundamental network security measure that prevents unauthorized network traffic from reaching the endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the endpoint to be deployed within a VPC and control traffic using security groups and network ACLs.
Why this is correct
Deploying inside a VPC allows network-level access control.
- ✗
Use a resource-based IAM policy on the endpoint to restrict invocation.
Why it's wrong here
SageMaker endpoints do not support resource-based policies directly; you use IAM roles.
- ✗
Place an Amazon API Gateway in front of the endpoint with AWS WAF.
Why it's wrong here
API Gateway is not a standard method; SageMaker endpoints can be invoked directly with IAM auth.
- ✗
Attach a security group directly to the SageMaker endpoint.
Why it's wrong here
Security groups are associated with the network interfaces of the endpoint, not directly attached.
- ✓
Use an IAM policy that requires authentication for the sagemaker:InvokeEndpoint action.
Why this is correct
IAM policies can restrict who can invoke the endpoint.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLA-C01 question from scratch — 835 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.