A company is using Amazon SageMaker to develop ML models. The company stores sensitive training data in an Amazon S3 bucket. The model training must have network isolation from the internet. Which…

Question

Options

• ARun the SageMaker training jobs in private subnets. Create a NAT gateway. Route traffic for
• BRun the SageMaker training jobs in private subnets. Create an S3 gateway VPC endpoint. Route
• CRun the SageMaker training jobs in public subnets that have an attached security group. In the
• DEncrypt traffic to Amazon S3 by using a bucket policy that includes a value of True for the

• A
  9% (4)
• B
  76% (34)
• C
  13% (6)
• D
  2% (1)

Explanation

Option B is correct because running SageMaker training jobs in private subnets removes direct internet access, and an S3 gateway VPC endpoint creates a private AWS-internal route to S3 - meaning training data never traverses the public internet, satisfying the isolation requirement.

Why the distractors fail:

• A is close but wrong: a NAT gateway routes outbound traffic through the internet to reach S3, which breaks network isolation despite using private subnets.
• C fails at the foundation: public subnets have internet gateway access by design; a security group restricts ports but does not eliminate internet exposure.
• D addresses encryption in transit (aws:SecureTransport), not network-level isolation - traffic still flows over the public internet, just encrypted.

Memory tip: Think of a gateway VPC endpoint as a "secret tunnel" that connects your VPC directly to S3 inside the AWS backbone, bypassing the internet entirely. Whenever a question asks for isolation + S3 access, the answer is almost always a VPC endpoint, not a NAT gateway (which is the "internet detour").

No community discussion yet for this question.