nerdexam
Amazon

MLS-C01 · Question #169

A company will use Amazon SageMaker to train and host a machine learning (ML) model for a marketing campaign. The majority of data is sensitive customer data. The data must be encrypted at rest. The…

The correct answer is C. Use customer managed keys in AWS Key Management Service (AWS KMS) to encrypt the ML. To meet the requirements of encrypting sensitive data at rest for SageMaker, having AWS maintain the root of trust, and logging key usage, customer managed keys in AWS Key Management Service (AWS KMS) are the ideal solution. KMS provides managed encryption keys with…

ML Implementation and Operations

Question

A company will use Amazon SageMaker to train and host a machine learning (ML) model for a marketing campaign. The majority of data is sensitive customer data. The data must be encrypted at rest. The company wants AWS to maintain the root of trust for the master keys and wants encryption key usage to be logged. Which implementation will meet these requirements?

Options

  • AUse encryption keys that are stored in AWS Cloud HSM to encrypt the ML data volumes, and to
  • BUse SageMaker built-in transient keys to encrypt the ML data volumes. Enable default encryption
  • CUse customer managed keys in AWS Key Management Service (AWS KMS) to encrypt the ML
  • DUse AWS Security Token Service (AWS STS) to create temporary tokens to encrypt the ML

How the community answered

(25 responses)
  • A
    16% (4)
  • B
    8% (2)
  • C
    72% (18)
  • D
    4% (1)

Why each option

To meet the requirements of encrypting sensitive data at rest for SageMaker, having AWS maintain the root of trust, and logging key usage, customer managed keys in AWS Key Management Service (AWS KMS) are the ideal solution. KMS provides managed encryption keys with hardware-backed security, where AWS maintains the underlying infrastructure and all key operations are logged to AWS CloudTrail.

AUse encryption keys that are stored in AWS Cloud HSM to encrypt the ML data volumes, and to

While AWS CloudHSM allows customers to manage their own keys in dedicated hardware security modules, it places more operational burden on the customer compared to the managed service approach of AWS KMS, where AWS fully maintains the HSM infrastructure.

BUse SageMaker built-in transient keys to encrypt the ML data volumes. Enable default encryption

SageMaker built-in encryption or default encryption typically uses AWS-managed keys (like SSE-S3 for S3 buckets), which offer less granular control over key policies and specific key usage logging from a customer's perspective compared to KMS CMKs, and "transient keys" is not a recognized SageMaker encryption feature for persistent storage.

CUse customer managed keys in AWS Key Management Service (AWS KMS) to encrypt the MLCorrect

Customer managed keys (CMKs) in AWS Key Management Service (AWS KMS) allow for data encryption at rest, with AWS maintaining the root of trust through its FIPS 140-2 validated hardware security modules, and all key usage is automatically logged to AWS CloudTrail, satisfying all specified requirements for securing sensitive data within SageMaker. SageMaker directly supports using KMS CMKs for encrypting training jobs, model artifacts, and inference endpoints.

DUse AWS Security Token Service (AWS STS) to create temporary tokens to encrypt the ML

AWS Security Token Service (STS) is used for providing temporary, limited-privilege credentials for AWS services or users, not for the creation, storage, or management of encryption master keys.

Concept tested: Data encryption with AWS KMS and SageMaker

Source: https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html

Topics

#AWS KMS#Data Encryption#SageMaker Security#Key Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MLS-C01 Practice