A company is working on an ML project that will include Amazon SageMaker notebook instances. An ML engineer must ensure that the SageMaker notebook instances do not allow root access. Which solution…

Question

Options

• AUse IAM condition keys to stop deployments of SageMaker notebook instances that allow root
• BUse AWS Key Management Service (AWS KMS) keys to stop deployments of SageMaker
• CMonitor resource creation by using Amazon EventBridge events. Create an AWS Lambda
• DMonitor resource creation by using AWS CloudFormation events. Create an AWS Lambda

• A
  77% (24)
• B
  6% (2)
• C
  3% (1)
• D
  13% (4)

Explanation

Option A is correct because IAM condition keys provide a preventive control - specifically, the sagemaker:RootAccess condition key can be used in an IAM policy to explicitly Deny the CreateNotebookInstance and UpdateNotebookInstance actions whenever root access is set to Enabled, blocking the deployment before it ever happens.

Option B (KMS) is wrong because encryption keys control data confidentiality, not instance access permissions - KMS has no mechanism to enforce or restrict root access settings on notebook instances. Options C and D are both wrong for the same fundamental reason: EventBridge and CloudFormation event-based Lambda triggers are reactive, meaning the notebook instance would already be deployed before the Lambda could attempt remediation - this is detective/corrective control, not preventive. The question specifically asks for a solution that "prevents" deployment.

Memory tip: Think "IAM = Gate, EventBridge/CloudFormation = Alarm." For exam questions asking to prevent a misconfiguration at deployment time, IAM policies with condition keys are almost always the answer - they act as a locked gate before resources are created, while event-driven approaches only trigger after something already exists.

No community discussion yet for this question.