MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security
A financial services company must deploy a SageMaker endpoint that only accepts traffic from within a VPC and encrypts all data at rest and in transit using customer-managed KMS keys. They also need to prevent inter-container traffic from being visible to other users. Which combination of settings fulfills these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the endpoint with VPC-only mode, enable inter-container traffic encryption, and specify a KMS key for endpoint data encryption
VPC-only mode restricts traffic to the VPC. Inter-container traffic encryption ensures data in transit between containers is encrypted. KMS key specified in the endpoint configuration encrypts data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy the endpoint in a private subnet and use SageMaker Model Monitor to detect unauthorized access
Why it's wrong here
Private subnet does not enforce inter-container encryption; Model Monitor is for data quality, not security.
- ✗
Attach a security group that only allows inbound traffic from the VPC CIDR and enable data encryption using a KMS key
Why it's wrong here
Security groups alone do not provide inter-container encryption; also, endpoint data encryption requires specifying a KMS key in the endpoint configuration.
- ✗
Enable network isolation mode and use a VPC configuration with no public internet access
Why it's wrong here
Network isolation mode blocks all internet but does not enforce inter-container encryption.
- ✓
Configure the endpoint with VPC-only mode, enable inter-container traffic encryption, and specify a KMS key for endpoint data encryption
Why this is correct
VPC-only mode restricts traffic to the VPC, inter-container encryption secures container-to-container traffic, and KMS key encrypts data at rest.
Go deeper
Related to this question
About these practice questions
This MLA-C01 question is part of Courseiva's 835-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.