MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security
A data science team uses SageMaker Studio with a VPC-only mode. They need to access a private S3 bucket in the same VPC to read training data. The SageMaker Studio domain is configured with VPC-only mode. Which configuration ensures the Studio notebook can access the S3 bucket without traversing the public internet?
⚠ Common exam trap
Many exam-takers confuse S3 Gateway Endpoints (which are free and route traffic privately within AWS) with VPC Interface Endpoints (which use PrivateLink and incur costs), or mistakenly think IAM policies alone control network path, ignoring the need for a VPC endpoint to avoid public internet traversal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an S3 Gateway Endpoint in the VPC and attach a bucket policy that allows access from the VPC
An S3 Gateway Endpoint provides a private, VPC-only route to S3 without traversing the public internet. By attaching a bucket policy that restricts access to the VPC endpoint, the SageMaker Studio domain (configured with VPC-only mode) can securely read training data from the private S3 bucket using AWS PrivateLink.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the S3 bucket as public and restrict access by source IP
Why it's wrong here
Making the bucket public violates security best practices and does not avoid internet traversal for VPC-only mode.
- ✗
Configure a NAT Gateway in the public subnet and route Studio traffic through it
Why it's wrong here
A NAT Gateway allows outbound internet access but is not needed for private S3 access; a VPC endpoint is more secure and cost-effective.
- ✗
Use a SageMaker execution role with a policy that allows s3:GetObject from any network
Why it's wrong here
IAM permissions alone do not control network paths; without a VPC endpoint, traffic still goes over the internet.
- ✓
Create an S3 Gateway Endpoint in the VPC and attach a bucket policy that allows access from the VPC
Why this is correct
An S3 Gateway Endpoint allows private access to S3 without internet. The bucket policy must restrict access to the VPC endpoint.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLA-C01 question from scratch — 835 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.