A company runs an Amazon SageMaker domain in a public subnet of a newly created VPC. The network is configured properly, and ML engineers can access the SageMaker domain. Recently, the company…

Question

Options

• ACreate a security group inbound rule to deny traffic from the specific IP address. Assign the
• BCreate a network ACL inbound rule to deny traffic from the specific IP address. Assign the rule to
• CCreate a shadow variant for the domain. Configure SageMaker Inference Recommender to send
• DCreate a VPC route table to deny inbound traffic from the specific IP address. Assign the route

• A
  7% (2)
• B
  74% (20)
• C
  15% (4)
• D
  4% (1)

Explanation

Option B is correct because Network ACLs (NACLs) are the only AWS network control that supports explicit DENY rules. Since the SageMaker domain sits in a public subnet, you can add an inbound NACL rule that explicitly denies traffic from the offending IP address, and assign that NACL to the subnet - blocking the traffic before it ever reaches the domain.

Option A is wrong because Security Groups are stateful and only support ALLOW rules - there is no mechanism to explicitly deny a specific source IP. You can restrict access by narrowing allows, but you cannot block an already-known bad actor with a deny.

Option C is wrong because SageMaker Shadow Variants and Inference Recommender are ML inference tools (A/B testing, instance optimization) - they have no role in blocking network traffic.

Option D is wrong because VPC Route Tables control traffic routing (where packets are forwarded), not traffic filtering. They have no concept of deny rules based on source IP addresses.

Memory tip: Think of it as "NACLs = firewall with DENY power; Security Groups = allowlist only." When a question asks you to block a specific IP, NACL is almost always the answer - it's the only AWS construct in the VPC layer that lets you explicitly deny source IPs.

No community discussion yet for this question.