MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security
A financial services company must deploy a SageMaker endpoint that processes sensitive customer data. They require that all traffic between the endpoint and the model containers be encrypted, and that the endpoint cannot be accessed from outside a specific VPC. Which combination of settings should they use?
⚠ Common exam trap
It's easy for candidates to confuse network isolation mode with inter-container traffic encryption and VPC-only mode, as candidates often assume network isolation alone secures all traffic and access, but it does not encrypt inter-container communication or restrict inbound endpoint access to a VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable inter-container traffic encryption and configure the endpoint with VPC-only mode
Inter-container traffic encryption ensures that data between the SageMaker endpoint and the model containers is encrypted in transit, typically using TLS. Configuring the endpoint with VPC-only mode restricts all inference traffic to the specified VPC, preventing any access from outside that VPC. This combination directly addresses the requirements for encrypted inter-container traffic and VPC-restricted access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a private VPC and enable data encryption at rest using KMS
Why it's wrong here
Encryption at rest does not encrypt inter-container traffic nor restrict access to the VPC.
- ✓
Enable inter-container traffic encryption and configure the endpoint with VPC-only mode
Why this is correct
VPC-only mode makes the endpoint only accessible from the VPC, and inter-container traffic encryption encrypts data between containers.
- ✗
Enable network isolation mode and inter-container traffic encryption
Why it's wrong here
Network isolation prevents internet access but does not restrict endpoint access to the VPC; also, it does not encrypt inter-container traffic by itself.
- ✗
Deploy the endpoint in a private subnet and use a VPC endpoint for SageMaker API
Why it's wrong here
A private subnet and VPC endpoint restrict API calls but do not encrypt inter-container traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLA-C01 question from scratch — 835 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.