MLS-C01 · Question #136
A machine learning specialist is developing a proof of concept for government users whose primary concern is security. The specialist is using Amazon SageMaker to train a convolutional neural…
The correct answer is D. Enable network isolation for training jobs. If you enable network isolation, the containers can't make any outbound network calls, even to other AWS services such as Amazon S3. Additionally, no AWS credentials are made available to the container runtime environment. In the case of a training job with multiple instances…
Question
A machine learning specialist is developing a proof of concept for government users whose primary concern is security. The specialist is using Amazon SageMaker to train a convolutional neural network (CNN) model for a photo classifier application. The specialist wants to protect the data so that it cannot be accessed and transferred to a remote host by malicious code accidentally installed on the training container. Which action will provide the MOST secure protection?
Options
- ARemove Amazon S3 access permissions from the SageMaker execution role.
- BEncrypt the weights of the CNN model.
- CEncrypt the training and validation dataset.
- DEnable network isolation for training jobs.
How the community answered
(46 responses)- A7% (3)
- B4% (2)
- C15% (7)
- D74% (34)
Explanation
If you enable network isolation, the containers can't make any outbound network calls, even to other AWS services such as Amazon S3. Additionally, no AWS credentials are made available to the container runtime environment. In the case of a training job with multiple instances, network inbound and outbound traffic is limited to the peers of each training container. SageMaker still performs download and upload operations against Amazon S3 using your SageMaker execution role in isolation from the training or inference container.
Topics
Community Discussion
No community discussion yet for this question.