A company runs an ML model on Amazon SageMaker. The company uses an automatic process that makes API calls to create training jobs for the model. The company has new compliance rules that prohibit…

Question

Options

• AOpt out of metadata tracking for any training job that is submitted.
• BEnsure that training jobs are running in a private subnet in a custom VPC.
• CEncrypt the training data with an AWS Key Management Service (AWS KMS) customer managed
• DReconfigure the training jobs to use only AWS Nitro instances.

• A
  91% (39)
• B
  2% (1)
• C
  5% (2)
• D
  2% (1)

Explanation

Option A is correct because Amazon SageMaker provides a built-in mechanism to disable the collection of aggregated metadata (such as profiling data and system metrics) on a per-job basis via the DisableProfiler flag or by configuring the profiler to not collect data - this directly addresses the compliance requirement at the training job level.

Option B is wrong because running jobs in a private subnet/VPC controls network egress and isolation, but does not prevent SageMaker's internal metadata collection mechanisms from operating.

Option C is wrong because KMS encryption protects the confidentiality of your training data at rest, but has no effect on whether SageMaker collects operational metadata about the job itself.

Option D is wrong because AWS Nitro instances provide hardware-level security isolation and are used broadly across EC2/SageMaker, but the instance type has no bearing on whether SageMaker's metadata tracking is enabled or disabled.

Memory tip: Think "opt out = turn off" - when a compliance rule says stop collecting, you need a collection toggle, not a network fence (B), an encryption key (C), or a hardware swap (D). Only A directly controls what SageMaker collects.

No community discussion yet for this question.