MLA-C01 · topic practice

ML Solution Monitoring, Maintenance, and Security practice questions

Q: How should I use these ML Solution Monitoring, Maintenance, and Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just ML Solution Monitoring, Maintenance, and Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the ML Solution Monitoring, Maintenance, and Security domain.

This domain covers operating ML systems after deployment on AWS: detecting drift and data quality issues, monitoring model performance, maintaining lineage and versioning, and securing data and endpoints. Questions present operational scenarios and ask you to choose the correct SageMaker or AWS service, configuration setting, or remediation step.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: ML Solution Monitoring, Maintenance, and Security

Practice 10 questions Browse domain →

What the exam tests

What to know about ML Solution Monitoring, Maintenance, and Security

You must be able to select the right SageMaker monitoring, lineage, and security configuration for a deployed model scenario. The most important thing is knowing which service detects drift versus which one records lineage, and enabling the correct encryption setting for training traffic.

SageMaker Model Monitor for data drift, model quality, bias, and feature attribution monitoring

SageMaker Lineage Tracking and Model Registry for dataset, hyperparameter, and model version lineage

SageMaker training job network isolation and inter-container traffic encryption settings

SageMaker JumpStart deployment options and cost tradeoffs such as serverless inference versus real-time endpoints

Watch out for

Common ML Solution Monitoring, Maintenance, and Security exam traps

▸Assuming Model Monitor automatically retrains or fixes drift; it only detects and reports, so remediation must be configured separately.
▸Confusing Model Registry versioning with Lineage Tracking; lineage records artifact relationships, while the registry manages approval and deployment status.
▸Forgetting that inter-container encryption requires enabling the specific training job encryption setting, not just an encryption key on the volume.

Practice set

ML Solution Monitoring, Maintenance, and Security questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full ML Solution Monitoring, Maintenance, and Security explanation →

A financial services company must deploy a SageMaker endpoint that processes sensitive customer data. They require that all traffic between the endpoint and the model containers be encrypted, and that the endpoint cannot be accessed from outside a specific VPC. Which combination of settings should they use?

Trap 1: Use a private VPC and enable data encryption at rest using KMS

Encryption at rest does not encrypt inter-container traffic nor restrict access to the VPC.

Trap 2: Enable network isolation mode and inter-container traffic encryption

Network isolation prevents internet access but does not restrict endpoint access to the VPC; also, it does not encrypt inter-container traffic by itself.

Trap 3: Deploy the endpoint in a private subnet and use a VPC endpoint for…

A private subnet and VPC endpoint restrict API calls but do not encrypt inter-container traffic.

Study all ML Solution Monitoring, Maintenance, and Security common traps →

A
Use a private VPC and enable data encryption at rest using KMS
Why it fails: Encryption at rest does not encrypt inter-container traffic nor restrict access to the VPC.
B
Enable inter-container traffic encryption and configure the endpoint with VPC-only mode
Enabling inter-container traffic encryption satisfies the requirement that traffic between the endpoint and model containers be encrypted, while VPC-only mode ensures the endpoint cannot be accessed from outside the specified VPC. Together these settings meet both constraints: encryption in transit and network isolation.
C
Enable network isolation mode and inter-container traffic encryption
Why it fails: Network isolation prevents internet access but does not restrict endpoint access to the VPC; also, it does not encrypt inter-container traffic by itself.
D
Deploy the endpoint in a private subnet and use a VPC endpoint for SageMaker API
Why it fails: A private subnet and VPC endpoint restrict API calls but do not encrypt inter-container traffic.

ML Solution Monitoring, Maintenance, and Security practice questions

What to know about ML Solution Monitoring, Maintenance, and Security

Common ML Solution Monitoring, Maintenance, and Security exam traps

ML Solution Monitoring, Maintenance, and Security questions

A company needs to give a data science team in another AWS account access to deploy a model from a shared model registry. Which approach should they use to grant cross-account access?

A company wants to automatically trigger model retraining when SageMaker Model Monitor detects data drift. Which TWO services should they integrate to achieve this automation? (Choose two.)

A company wants to secure data in transit between the client and SageMaker endpoint, and between containers in the same endpoint. Which THREE configurations should they apply? (Choose three.)

A machine learning engineer is setting up model quality monitoring for a binary classification model. They have ground truth labels available in Amazon S3. Which TWO steps are required to configure model quality monitoring? (Choose two.)

A company deploys a model for credit risk assessment on a SageMaker endpoint. To comply with internal policies, they must ensure that the endpoint only allows inference requests from within a specific VPC and that the data is encrypted at rest. Which configuration meets these requirements?

A machine learning team uses SageMaker Pipelines and wants to automatically retrain a model when data drift is detected. They have set up Model Monitor to publish drift violations to CloudWatch. Which approach provides a COMPLETE serverless retraining pipeline triggered by drift detection?

A company notices that the prediction distribution of their deployed model has shifted significantly from the training data distribution, but the input data distribution remains unchanged. Which type of drift is occurring, and what is the MOST likely cause?

An ML team wants to monitor the cost of their SageMaker endpoints. They have observed that some endpoints are underutilized. Which AWS offering can help them reduce costs by committing to a consistent amount of usage in exchange for a lower price?

A company deploys a model in a different AWS account for production. They want to allow the production account to invoke the model endpoint from a SageMaker notebook in the same account, while keeping the model in the original account. Which configuration is required?

A company uses SageMaker Model Monitor to detect data drift. They want to receive alerts when drift is detected and automatically trigger a retraining pipeline. Which TWO steps should they implement? (Select TWO.)

A financial services company uses SageMaker Studio. They require that all Studio traffic remains within the corporate network and that user notebooks cannot access the internet. Which TWO configurations should they implement? (Select TWO.)

A financial services company deploys a fraud detection model with a SageMaker endpoint. They need to ensure that all data sent to the endpoint is encrypted in transit and at rest, and that the endpoint cannot be accessed from the public internet. Which combination of settings should they use?

A team wants to automatically retrain a model whenever data drift is detected on their SageMaker endpoint. Which AWS service should they use to invoke a retraining pipeline in response to a CloudWatch Alarm?

A company uses SageMaker Model Monitor to track feature attribution drift with SHAP. They notice that the SHAP values have changed significantly for a feature, while the model performance remains stable. What is the MOST likely interpretation?

A machine learning engineer deploys a multi-model endpoint using SageMaker. They need to track which model version was used for each inference request for compliance purposes. Which service should they integrate to capture this lineage?

A team trains a model using SageMaker and wants to ensure that the training job cannot access the internet, but needs to access a private S3 bucket in the same VPC. Which configuration should they use?

A machine learning team wants to monitor bias in a deployed model's predictions on an ongoing basis. Which AWS service should they use to schedule bias monitoring jobs and generate reports?

A machine learning team wants to detect concept drift in a production model. Which TWO actions should they take? (Choose TWO)

Track your progress over time

Start a ML Solution Monitoring, Maintenance, and Security only practice session

Related MLA-C01 topic practice pages

ML Model Development practice questions

Data Preparation for Machine Learning practice questions

Deployment and Orchestration of ML Workflows practice questions

ML Solution Monitoring, Maintenance, and Security practice questions

MLA-C01 fundamentals practice questions

MLA-C01 scenario practice questions

MLA-C01 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid