easyMultiple SelectObjective-mapped
MLA-C01 Practice Question: Which TWO actions are recommended best practices…
Which TWO actions are recommended best practices for securing an Amazon SageMaker notebook instance? (Select TWO.)
⚠ Common exam trap
Test-takers frequently confuse network-level controls (network ACLs) with API-level controls (IAM/VPC endpoints), or they mistakenly think Multi-AZ applies to all AWS services, when in fact it is specific to database and high-availability services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS KMS to encrypt the notebook instance's storage volume.
Encrypting the notebook instance's storage volume with AWS KMS ensures data-at-rest protection, which is a fundamental security best practice. SageMaker notebook instances use Amazon EBS volumes for storage, and KMS encryption safeguards sensitive code, datasets, and model artifacts stored on that volume against unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use network ACLs to restrict API calls to the SageMaker API.
Why it's wrong here
Network ACLs are for network traffic, not API authorization.
- ✗
Enable Multi-AZ deployment for the notebook instance.
Why it's wrong here
Multi-AZ is not supported for notebook instances.
- ✓
Use AWS KMS to encrypt the notebook instance's storage volume.
Why this is correct
KMS encryption protects data at rest.
- ✗
Associate the notebook instance with a public subnet that has an internet gateway.
Why it's wrong here
A public subnet with internet gateway increases exposure.
- ✓
Disable direct internet access for the notebook instance.
Why this is correct
Disabling internet access reduces attack surface.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This MLA-C01 question is part of Courseiva's 835-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.