MLA-C01 Practice Question: ML Solution Monitoring, Maintenance, and Security
An organization needs to ensure that all data transmitted between containers in a SageMaker training job is encrypted. In the training job configuration, which setting should they enable?
⚠ Common exam trap
Test-takers frequently confuse encryption at rest (KMS keys) with encryption in transit, or assume VPC-only mode or network isolation automatically encrypts inter-container traffic, when in fact they only control network boundaries without enabling TLS encryption between containers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable inter-container traffic encryption
SageMaker training jobs support inter-container traffic encryption, which ensures that data transmitted between containers (e.g., distributed training workers) is encrypted in transit. This setting uses TLS to protect the communication channel, meeting the organization's requirement for encrypted data transmission between containers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a KMS key for data encryption
Why it's wrong here
A KMS key encrypts data at rest, such as volumes and artefacts, not traffic between containers during a training job. It is the correct choice for at-rest encryption of training data and output models, but inter-container traffic encryption needs the encrypt inter-container traffic setting enabled.
- ✗
Configure the training job in VPC-only mode
Why it's wrong here
VPC-only mode restricts network routing to a customer VPC, controlling where traffic flows rather than encrypting it between containers. It suits isolating training jobs within private networking, but the requirement for encrypted inter-container transmission is met by enabling the encrypt inter-container traffic setting.
- ✓
Enable inter-container traffic encryption
Why this is correct
Inter-container traffic encryption secures the peer-to-peer channel between containers within the same training job, using TLS on the network interfaces. Enabling it in the job configuration satisfies the requirement that data transmitted between containers is encrypted, covering traffic that volume-level or at-rest encryption does not protect.
- ✗
Enable network isolation mode
Why it's wrong here
Network isolation blocks all outbound network traffic from containers, including inter-container communication, rather than encrypting it; it suits preventing containers from reaching the internet or other resources. Inter-container traffic encryption requires enabling the encrypt inter-container traffic setting, which applies TLS to that channel.
Go deeper
Related to this question
About these practice questions
This MLA-C01 question is part of Courseiva's 665-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.