MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security

A financial services company has a SageMaker real-time endpoint serving a fraud detection model. Compliance requires that all inference requests and responses be logged with the ability to detect anomalous input feature distributions over time. The team wants a managed solution that captures request/response payloads to Amazon S3 and automatically computes statistics and constraints against a baseline. Which combination of SageMaker features should they enable?

⚠ Common exam trap

The trap here is assuming that CloudWatch Logs or CloudTrail alone can provide managed drift detection, when they only capture logs or API activity and require custom analysis.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable SageMaker Model Monitor data capture on the endpoint and schedule a monitoring job using the baseline constraints and statistics.

SageMaker Model Monitor is the managed service for monitoring deployed models. Data capture stores inference request and response data in S3, and monitoring schedules compare that data to a baseline to detect data drift, model quality issues, bias, and feature attribution drift. This provides both the audit trail and the automated anomaly detection required.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure the endpoint to write inference logs to Amazon CloudWatch Logs and create a custom Lambda function to parse and analyze the logs.
Why it's wrong here
CloudWatch Logs can receive endpoint logs, but this approach requires custom parsing and analysis code and does not provide managed baseline statistics, constraints, or drift detection. It also lacks the structured data capture format that Model Monitor uses for automated monitoring.
✓
Enable SageMaker Model Monitor data capture on the endpoint and schedule a monitoring job using the baseline constraints and statistics.
Why this is correct
SageMaker Model Monitor data capture records request and response payloads to S3, and the monitoring schedule evaluates them against a baseline to detect drift and anomalies. This directly satisfies the compliance need to log inference traffic and detect anomalous feature distributions without custom code.
✗
Enable SageMaker Debugger on the endpoint and configure rules to monitor for data drift.
Why it's wrong here
SageMaker Debugger is designed for training job debugging, capturing tensors and gradients during training. It does not operate on real-time inference endpoints and has no built-in capability to capture inference payloads or compute drift statistics against a production baseline.
✗
Enable AWS CloudTrail data events on the S3 bucket used by the endpoint and configure Amazon CloudWatch Logs metric filters.
Why it's wrong here
CloudTrail data events log S3 object-level API activity, not inference payloads, and CloudWatch Logs metric filters only operate on log patterns. Neither captures the actual request/response feature values, so drift in input distributions cannot be detected from this data.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question