nerdexam
Amazon

MLS-C01 · Question #347

A company decides to use Amazon SageMaker to develop machine learning (ML) models. The company will host SageMaker notebook instances in a VPC. The company stores training data in an Amazon S3…

The correct answer is B. Configure the VPC that contains the SageMaker notebook instances to use VPC interface. To ensure SageMaker notebook instances in a private VPC can access S3 without internet connectivity, configure VPC interface endpoints.

Machine Learning Implementation and Operations

Question

A company decides to use Amazon SageMaker to develop machine learning (ML) models. The company will host SageMaker notebook instances in a VPC. The company stores training data in an Amazon S3 bucket. Company security policy states that SageMaker notebook instances must not have internet connectivity. Which solution will meet the company's security requirements?

Options

  • AConnect the SageMaker notebook instances that are in the VPC by using AWS Site-to-Site VPN
  • BConfigure the VPC that contains the SageMaker notebook instances to use VPC interface
  • CCreate an IAM policy that prevents access the internet. Apply the IAM policy to an IAM role.
  • DCreate VPC security groups to prevent all incoming and outgoing traffic. Assign the security

How the community answered

(47 responses)
  • A
    4% (2)
  • B
    85% (40)
  • C
    2% (1)
  • D
    9% (4)

Why each option

To ensure SageMaker notebook instances in a private VPC can access S3 without internet connectivity, configure VPC interface endpoints.

AConnect the SageMaker notebook instances that are in the VPC by using AWS Site-to-Site VPN

AWS Site-to-Site VPN connects a VPC to an on-premises network and is not used for enabling private access to AWS services like S3 from within the same AWS VPC.

BConfigure the VPC that contains the SageMaker notebook instances to use VPC interfaceCorrect

Configuring the VPC that contains the SageMaker notebook instances to use VPC interface endpoints (powered by AWS PrivateLink) for Amazon S3 allows private and secure communication directly to S3 from within the VPC, without requiring an internet gateway, NAT gateway, or any internet connectivity.

CCreate an IAM policy that prevents access the internet. Apply the IAM policy to an IAM role.

An IAM policy controls permissions for actions but does not physically block network traffic; network-level controls are required to prevent internet connectivity.

DCreate VPC security groups to prevent all incoming and outgoing traffic. Assign the security

Creating VPC security groups to prevent *all* incoming and outgoing traffic would isolate the notebook instances completely, preventing necessary communication with S3 and other SageMaker services, making them unusable.

Concept tested: SageMaker Private VPC Connectivity

Source: https://docs.aws.amazon.com/sagemaker/latest/dg/athena-vpc.html

Topics

#SageMaker Networking#VPC Endpoints#Network Security#Private Connectivity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MLS-C01 Practice