CCNA Mla Monitoring Security Questions

Option D is correct because it uses an EventBridge rule to listen for SageMaker Model Monitor violation events (e.g., `aws.sagemaker.model-monitoring-violation`), which then triggers a Lambda function that starts the latest approved pipeline version in SageMaker Pipelines. This creates an automated, event-driven retraining pipeline without manual intervention or scheduled polling.

Option C is correct because configuring auto-scaling with a target tracking policy allows the endpoint to dynamically add more instances under high load, distributing the traffic and reducing HTTP 5XX errors. Since the team cannot change the instance type, scaling out is the most cost-effective way to handle increased demand, as it only adds capacity when needed and avoids over-provisioning.

Option A is correct because schema drift occurs when the structure or data types of features in production data differ from the baseline used during model training. In this scenario, a feature that was an integer in the baseline is now a string in production, which is a classic example of schema drift. SageMaker Model Monitor detects this by comparing the inferred schema of production data against the baseline schema, flagging any type mismatches as constraint violations.

SageMaker ML Lineage Tracking creates a graph of artifacts (datasets, models) and actions (training jobs, endpoints) to track the provenance of ML workflows.

SageMaker Model Monitor detects data drift and can publish to CloudWatch Metrics. CloudWatch Alarms can trigger an SNS topic, which invokes a Lambda function that starts a SageMaker Pipeline for retraining.

CloudWatch Alarms monitor metrics and trigger actions. SNS can notify and invoke Lambda for automated remediation. EventBridge is used for scheduled events, not direct alarm actions.

SageMaker Model Monitor can be configured to run monitoring jobs that compare live inference data against a baseline created from training data to detect data drift.

Option D is correct because auto-scaling with a target tracking policy based on Invocations per instance dynamically adjusts the number of instances to match demand, ensuring you only pay for the compute capacity you need while maintaining low latency. This avoids over-provisioning and reduces idle costs, directly addressing the goal of minimizing inference costs.

SageMaker ML Lineage Tracking is the correct service because it is specifically designed to capture and query the lineage of machine learning artifacts, including model versions, datasets, and inference requests. By integrating with SageMaker endpoints, it automatically records the model version used for each inference, enabling compliance auditing without custom code.

EventBridge can schedule or trigger events based on monitoring job completions, and Lambda can execute the retraining code. SNS is used for notifications but not direct invocation of retraining. Step Functions can orchestrate but is not required for this simple trigger.

Option D is correct because configuring a SageMaker Studio domain with VPC-only mode and disabling direct internet access ensures that all Studio notebook traffic stays within the VPC and has no route to the public internet. This is the only configuration that both restricts internet access and enforces data residency within the VPC by using VPC-only networking, which does not rely on an internet gateway or NAT gateway for outbound traffic.

VPC-only mode restricts all traffic to the VPC, and inter-container traffic encryption ensures data in transit within the job is encrypted. These two settings together meet the requirements.

A is correct because SageMaker ML Lineage Tracking automatically captures the relationships between datasets, training jobs, and model versions, creating a directed acyclic graph (DAG) of the ML workflow. This enables full reproducibility by allowing you to trace which data and code produced a specific model, without manual intervention.

SageMaker ML Lineage Tracking automatically records the relationships between artifacts (datasets, jobs, models, endpoints) and tracks the provenance of ML workflows.

Option C is correct because SageMaker Model Monitor for model quality requires a ground truth labels dataset to compare the model's predictions against actual outcomes. This comparison is essential for calculating quality metrics like accuracy, precision, recall, or F1 score, which indicate how well the model is performing over time.

SageMaker Savings Plans offer a flexible pricing model where you commit to a consistent amount of compute usage (measured in dollars per hour) over a 1- or 3-year term, in exchange for a lower price compared to On-Demand rates. This directly addresses the goal of reducing costs for underutilized endpoints by allowing the team to pay a discounted rate for the baseline usage they commit to, regardless of whether the endpoint is fully utilized.

SageMaker Model Monitor's data quality monitoring detects feature distribution drift (statistical drift) between baseline and live data. Model quality monitoring requires ground truth labels, bias drift monitors fairness metrics, and feature attribution drift monitors SHAP values.

Option D is correct because configuring the SageMaker endpoint in VPC-only mode ensures that inference requests can only originate from within the specified VPC, satisfying the network restriction requirement. Enabling KMS encryption for the endpoint encrypts the model data and inference data at rest using a customer-managed key, meeting the encryption-at-rest policy.

SageMaker training jobs can be configured with VPC settings. Enabling network isolation prevents internet access, but the job still needs VPC connectivity to reach S3 via VPC endpoints. Setting the VPC config allows access to private resources.

SHAP values measure the contribution of each feature to the model's predictions. A change in SHAP values while input distribution is stable suggests the model has learned a new reliance on that feature, i.e., the relationship between the feature and the target has changed — concept drift.

Option B is correct because SageMaker Model Monitor publishes metrics to CloudWatch, and when data drift is detected, a CloudWatch Alarm triggers an SNS notification, which invokes a Lambda function to start a SageMaker Processing job for retraining. This architecture decouples monitoring from retraining and uses native AWS services for event-driven automation.

Option A is correct because the InvocationsPerInstance metric is a predefined SageMaker metric that Application Auto Scaling can use with a target tracking scaling policy. This policy automatically adjusts the number of instances to maintain a target value for invocations per instance, directly reducing costs by scaling down when demand is low.

Option D is correct because Amazon SNS can directly subscribe to a CloudWatch Alarm and, upon alarm state change, publish a message to an SNS topic. That topic can then trigger an AWS Lambda function, which invokes the retraining pipeline (e.g., SageMaker Processing or training job). This creates a fully managed, serverless event-driven workflow without needing custom polling or additional orchestration services.

Option A is correct because SageMaker endpoints support resource-based policies that allow cross-account access. By attaching a resource-based policy to the model endpoint in Account A, you can grant the IAM role from Account B explicit permission to invoke the endpoint. This is the standard AWS mechanism for cross-account SageMaker endpoint invocation without needing to duplicate the model.

Resource-based policies (also called resource policies) can be attached to the model registry to allow cross-account access. IAM roles are used for intra-account access, not for granting access to resources in another account.

Option D is correct because the `CreateModel` API in SageMaker accepts a `ModelKmsKeyId` parameter that specifies a customer-managed KMS key for encrypting the model artifacts at rest. This key is used when SageMaker copies the artifacts from S3 to the inference instance's Amazon EBS volume, ensuring encryption at rest. The other options either apply to different resources or do not control the encryption of the model artifacts themselves.

VPC-only mode restricts traffic to the VPC. Inter-container traffic encryption ensures data in transit between containers is encrypted. KMS key specified in the endpoint configuration encrypts data at rest.

OverheadLatency measures the time taken by the SageMaker infrastructure to handle requests before and after model inference, including request routing, authentication, and response processing. Since ModelLatency is stable but total endpoint latency has increased, the extra time must be in the overhead component, making OverheadLatency the correct metric to investigate.

SageMaker Clarify bias drift monitoring compares predicted outcomes (post-training) against the baseline to detect changes in fairness metrics like disparate impact. It does not measure prediction accuracy or data quality.

SageMaker Studio in VPC-only mode (no internet access) combined with VPC-only mode for the domain and VPC endpoints to private PyPI mirror enables package installation from the private mirror. NAT gateway or internet gateway would allow internet access, which is not desired.

SageMaker endpoints use AWS KMS for encryption at rest. By specifying a KMS key in the endpoint configuration, the data in the attached ML storage volume is encrypted. Inter-container traffic encryption is for encryption in transit.

Option B is correct because a CloudWatch Alarm on the 5XXError metric can be configured to publish to an SNS topic, enabling automated notifications or remediation actions (e.g., via Lambda) when the alarm state is triggered. This is the standard AWS approach for alerting on endpoint errors without custom polling.

Option C is correct because using a KMS key for endpoint data encryption at rest ensures that the model data and artifacts stored on the endpoint's ML storage volumes are encrypted. This is a required step for meeting encryption compliance, though the question specifically asks about data in transit; however, KMS encryption at rest is a standard security best practice and is listed as a correct answer in the context of overall data protection for the endpoint.

Concept drift occurs when the underlying relationship between features and target changes. Model quality monitoring (comparing predictions against ground truth) detects this. Data drift monitors feature distribution changes, which are not present here.

SageMaker Model Monitor's Data Quality Monitor is specifically designed to detect data drift by comparing the statistical distribution of incoming inference data against a baseline computed from the training dataset. This capability tracks metrics like mean, variance, and quantiles for each feature, alerting when significant deviations occur. For a fraud detection model requiring real-time monitoring of input distributions, this is the correct choice.

Serverless endpoints in SageMaker automatically scale to zero when not in use, so you pay only for the compute time consumed during inference requests. This makes them the most cost-effective option for intermittent traffic, as you avoid paying for idle compute capacity.

Target tracking scaling policies automatically adjust instance count based on a metric like invocation count or CPU utilization. Step scaling can also be used but target tracking is simpler and more cost-effective for predictable patterns.

SageMaker JumpStart provides pre-built models; for cost optimization, choosing the smallest suitable instance type and enabling auto-scaling based on demand reduces cost while handling varying traffic.

Data drift (option C) is the correct proxy to monitor when ground truth labels are unavailable because it detects changes in the input feature distribution over time. If the underlying data distribution shifts, the model's predictions are likely to become less accurate even if the relationship between features and labels remains stable. This allows teams to trigger retraining or investigation before model quality degrades.

Scheduled scaling with Application Auto Scaling can anticipate traffic spikes. Pre-warming endpoints or using provisioned concurrency are not native SageMaker features. Step scaling reacts to deviations but still after the fact.

CloudWatch Alarms can be set on Model Monitor violation metrics. The alarm triggers an SNS topic that invokes a Lambda function to start a retraining pipeline. This requires minimal custom code.

Option A is correct because adding an SNS topic as the alarm action enables automated notifications when the CloudWatch Alarm triggers on the 5XXError metric. This allows the team to receive alerts and trigger downstream remediation workflows, such as invoking a Lambda function, without manual intervention.

Data quality monitoring in SageMaker Model Monitor detects schema and statistical drift (including distribution changes) for input features. Model quality monitors predictions vs. ground truth, not input features.

SageMaker Model Monitor requires a baseline from training data, then schedules monitoring jobs that compare live endpoint captures against that baseline. Alerts are sent via CloudWatch Alarms.

Option C is correct because enabling VPC-only mode restricts all SageMaker Studio traffic to the VPC, preventing any internet-bound communication, while inter-container traffic encryption ensures that data exchanged between the Studio app and the kernel gateway is encrypted in transit using TLS. This combination satisfies both requirements: network confinement to the VPC and encryption of inter-component traffic.

ModelLatency is the time taken by the model to respond, and OverheadLatency is the additional time added by SageMaker infrastructure. Invocations is count, not duration; Latency is total latency (ModelLatency + OverheadLatency).

Option B is correct because SageMaker allows you to attach a resource-based policy directly to the model resource in the central account, granting the SageMaker service principal from other accounts permission to call `sagemaker:CreateModel` and `sagemaker:CreateEndpointConfig` using the shared model. This approach avoids copying artifacts and leverages AWS Identity and Access Management (IAM) cross-account trust, where the central account's model policy explicitly allows the remote account's SageMaker service role to access the model and its underlying S3 objects.

SageMaker ML Lineage Tracking is the correct choice because it is specifically designed to create a directed acyclic graph (DAG) of every step in the ML workflow, including dataset versions, hyperparameters, training jobs, and model artifacts. This enables full reproducibility and audit compliance by capturing the provenance of each entity and their relationships, which is exactly what the question requires.

Enforce inter-container traffic encryption, use HTTPS for the endpoint, and enable network isolation to prevent internet exposure. VPC-only mode controls network access but does not directly encrypt traffic.

Concept drift is detected by comparing model predictions to actual outcomes (ground truth). Capturing ground truth and using model quality monitoring is essential. Data quality monitoring would not detect concept drift.

A sudden increase in 5XX errors, particularly HTTP 503 or 502, typically indicates that the model container is failing to process requests due to resource exhaustion (e.g., OOM kills) or a crash in the inference process. In a production ML endpoint, such errors often stem from the container running out of memory, leading to the container being terminated by the orchestrator (e.g., Kubernetes OOMKill) or the application crashing internally, which directly causes 5XX responses.

SageMaker Model Monitor – Data Quality Monitoring is the correct choice because it is specifically designed to detect deviations in the distribution of input features compared to the training data distribution. It continuously monitors incoming inference requests and compares statistical properties (e.g., mean, variance, or histogram) against a baseline computed from the training dataset, alerting when drift is detected.

SageMaker Clarify provides post-deployment bias monitoring by analyzing predictions against ground truth labels for defined facets. It can track metrics like false positive rate differences over time.

Option C is correct because enabling SageMaker Studio in VPC-only mode ensures that the Studio environment is accessible only from within the corporate network by routing all traffic through a VPC with no public internet access. Additionally, using a KMS key for data encryption provides customer-managed encryption for data at rest and in transit within the Studio environment, meeting the encryption requirement.

Option C is correct because scheduled scaling directly aligns capacity with the predictable traffic pattern (business hours vs. night), allowing you to proactively add instances before demand increases and remove them afterward. This avoids the cost of over-provisioning during low-traffic periods and the latency of reactive scaling, making it the most cost-effective approach for a known, recurring schedule.

Option C is correct because CloudWatch Alarms cannot directly invoke SageMaker training jobs; they require an intermediary like SNS to trigger a Lambda function, which then calls the SageMaker API to start the training job. This pattern ensures reliable decoupling and allows the Lambda function to handle any preprocessing or conditional logic before launching the job.

In SageMaker ML Lineage Tracking, datasets are represented as Artifacts. Actions represent processes like training, and Contexts group related entities.

SageMaker Clarify is the correct service because it is specifically designed to detect bias in ML model predictions and can be configured for ongoing monitoring. It provides bias metrics (e.g., difference in positive proportion, disparate impact) and can run on a schedule to continuously evaluate predictions against demographic groups, ensuring regulatory compliance over time.

To restrict access to a VPC, use a VPC endpoint for SageMaker. To enforce that only requests from that VPC are accepted, use a resource policy that denies requests unless they come via the VPC endpoint. Inter-container traffic encryption secures data between containers, but for endpoint invocation, using a VPC endpoint with encryption ensures data in transit is encrypted.

Option D is correct because enabling VPC-only mode for the SageMaker endpoint ensures the endpoint is not accessible from the public internet, and setting EnableInterContainerTrafficEncryption to True encrypts data in transit between containers within the endpoint. This combination directly satisfies the requirements for no public internet access and encrypted data in transit, while the model containers are isolated from outbound internet requests by the VPC configuration.

When the input data is encrypted with a customer-managed KMS key, you must specify the same KMS key in the VolumeKmsKeyId parameter of the training job to encrypt the ML storage volume, and also set the OutputKmsKeyId for output encryption.

SageMaker Clarify bias drift monitor compares the bias metrics computed on current predictions against the baseline bias metrics computed from the training data or from an earlier period. It does not compare against model quality metrics or SHAP values. The baseline is typically established during the initial monitoring setup.

Amazon S3 versioning is correct because it preserves every version of an object stored in an S3 bucket, including model artifacts, datasets, and configuration files. By enabling versioning, you can retrieve and revert to any previous version of a model artifact, which is essential for reproducibility and auditability. This directly supports tracking the lineage of ML models by ensuring that the exact input data and model binaries used in a specific experiment are never overwritten or lost.