nerdexam
Amazon

MLS-C01 · Question #221

A company will use Amazon SageMaker to train and host a machine learning model for a marketing campaign. The data must be encrypted at rest. Most of the data is sensitive customer data. The company…

The correct answer is B. Use customer managed keys in AWS Key Management Service (AWS KMS) to encrypt the. To encrypt sensitive data at rest for SageMaker, maintain AWS as the root of trust, log key usage, and minimize operational overhead, using AWS KMS customer managed keys is the most effective solution.

Machine Learning Implementation and Operations

Question

A company will use Amazon SageMaker to train and host a machine learning model for a marketing campaign. The data must be encrypted at rest. Most of the data is sensitive customer data. The company wants AWS to maintain the root of trust for the encryption keys and wants key usage to be logged. Which solution will meet these requirements with the LEAST operational overhead?

Options

  • AUse AWS Security Token Service (AWS STS) to create temporary tokens to encrypt the storage
  • BUse customer managed keys in AWS Key Management Service (AWS KMS) to encrypt the
  • CUse encryption keys stored in AWS CloudHSM to encrypt the storage volumes for all SageMaker
  • DUse SageMaker built-in transient keys to encrypt the storage volumes for all SageMaker

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    79% (23)
  • C
    7% (2)
  • D
    10% (3)

Why each option

To encrypt sensitive data at rest for SageMaker, maintain AWS as the root of trust, log key usage, and minimize operational overhead, using AWS KMS customer managed keys is the most effective solution.

AUse AWS Security Token Service (AWS STS) to create temporary tokens to encrypt the storage

AWS Security Token Service (AWS STS) provides temporary security credentials for access control, not persistent encryption keys for data at rest.

BUse customer managed keys in AWS Key Management Service (AWS KMS) to encrypt theCorrect

Customer managed keys in AWS KMS allow users to create and manage their own encryption keys, while AWS securely maintains the root of trust for these keys. KMS automatically logs key usage to AWS CloudTrail, fulfilling the logging requirement, and integrates seamlessly with SageMaker for data at rest encryption with minimal operational overhead.

CUse encryption keys stored in AWS CloudHSM to encrypt the storage volumes for all SageMaker

AWS CloudHSM provides dedicated hardware security modules for keys, offering high control but significantly increasing operational overhead compared to KMS.

DUse SageMaker built-in transient keys to encrypt the storage volumes for all SageMaker

SageMaker built-in transient keys refer to AWS-managed encryption for certain services, which does not provide customer-managed keys or explicit key usage logging control, failing to meet the specified requirements.

Concept tested: AWS KMS customer managed keys for SageMaker encryption

Source: https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html

Topics

#AWS KMS#Data Encryption at Rest#SageMaker Security#Operational Overhead

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MLS-C01 Practice