hardMultiple ChoiceObjective-mapped
Restricting SageMaker Notebook Access to a Specific IAM Role
A company wants to restrict access to a SageMaker notebook instance so that only a specific IAM role can open the notebook via JupyterLab. The notebook instance is associated with a lifecycle configuration that installs custom packages. What is the correct way to enforce access control?
Quick Answer
The correct answer is to grant the specific IAM role permission to call `sagemaker:CreatePresignedNotebookInstanceUrl` on that notebook instance. This action generates a time-limited URL that grants direct access to the JupyterLab interface, and by restricting this API call to only the designated role, you ensure that no other user or service can open the notebook—even if they have broader SageMaker permissions. On the AWS Certified Machine Learning Engineer Associate MLA-C01 exam, this question tests your understanding of fine-grained IAM policy conditions versus common misdirections like VPC-based network controls or AWS Systems Manager Session Manager, which manage connectivity but not identity-based access. A frequent trap is assuming that lifecycle configurations or instance-level settings enforce access, but they only handle software setup, not authentication. Remember the key: presigned URLs are the gatekeeper for notebook access, so lock the `CreatePresignedNotebookInstanceUrl` action to your chosen role.
⚠ Common exam trap
It's easy for candidates to confuse network-level controls (VPC, security groups, disabling internet access) with identity-based access control, mistakenly thinking that restricting network access is sufficient to prevent unauthorized users from opening the notebook, when in fact the presigned URL API is the only mechanism that ties JupyterLab access to a specific IAM role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the specific IAM role permission to call sagemaker:CreatePresignedNotebookInstanceUrl on that notebook instance.
The `sagemaker:CreatePresignedNotebookInstanceUrl` API action generates a URL that provides authenticated access to the notebook instance's JupyterLab interface. By granting this permission only to the specific IAM role, you ensure that only that role can call the API and obtain the presigned URL, effectively restricting access to the notebook. This is the native, recommended way to control access to a SageMaker notebook instance without relying on network-level controls or SSH proxies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the notebook instance's Direct Internet Access to disabled and use IAM authentication.
Why it's wrong here
Direct Internet Access controls internet connectivity, not notebook access.
- ✓
Grant the specific IAM role permission to call sagemaker:CreatePresignedNotebookInstanceUrl on that notebook instance.
Why this is correct
This action generates a presigned URL for accessing the notebook, and restricting it to the role enforces access control.
- ✗
Use AWS Systems Manager to proxy SSH access, then use IAM permission.
Why it's wrong here
Systems Manager is for SSH, but notebook instances use JupyterLab via presigned URL.
- ✗
Configure the notebook instance to use a VPC and restrict access via security groups.
Why it's wrong here
VPC and security groups control network access, not IAM user/role access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLA-C01 question from scratch — 835 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MLA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions are recommended best practices for securing an Amazon SageMaker notebook instance? (Select TWO.)
easy- A.Use network ACLs to restrict API calls to the SageMaker API.
- B.Enable Multi-AZ deployment for the notebook instance.
- ✓ C.Use AWS KMS to encrypt the notebook instance's storage volume.
- D.Associate the notebook instance with a public subnet that has an internet gateway.
- ✓ E.Disable direct internet access for the notebook instance.
Why C: Encrypting the notebook instance's storage volume with AWS KMS ensures data-at-rest protection, which is a fundamental security best practice. SageMaker notebook instances use Amazon EBS volumes for storage, and KMS encryption safeguards sensitive code, datasets, and model artifacts stored on that volume against unauthorized access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.