Amazon Web ServicesAssociate levelMLA-C01Page 2 of 5

MLA-C01 exam dumps: questions 101 to 200 of 457

Page 2 of the free MLA-C01 question bank for the AWS Certified Machine Learning Engineer - Associate exam. Questions 101 to 200 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated December 2024

Start timed practice exam Questions 101 to 200

Free MLA-C01 practice questions

Questions 101 to 105 of 457

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

MLA-C01 Question 101

Select 3

You are designing a machine learning pipeline to process sensitive financial data on AWS. To ensure compliance with data protection regulations, you need to encrypt the data at rest. Which of the following approaches could you use to securely encrypt the data stored in Amazon S3?

A
Use Amazon S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS).
B
Manually encrypt the data before uploading it to Amazon S3 using a client-side library like AWS SDK.
C
Store the data in an unencrypted Amazon S3 bucket but restrict access using IAM policies.
D
Enable Amazon S3 Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
E
Use AWS Secrets Manager to encrypt the data directly in Amazon S3.

Show answer and explanation

Correct answers: A, B, D

Explanation

To encrypt data at rest in Amazon S3, you can use either server-side encryption methods provided by AWS (SSE-KMS or SSE-S3) or implement client-side encryption before uploading the data. Both approaches ensure data is encrypted while stored in S3. IAM policies and AWS Secrets Manager, while useful for other aspects of security, do not directly meet the requirement of encrypting data at rest.

A. Correct.
Correct: SSE-KMS provides server-side encryption with keys managed by AWS Key Management Service, ensuring strong encryption and regulatory compliance.
B. Correct.
Correct: Client-side encryption allows you to encrypt data before uploading it to Amazon S3, giving you complete control over the encryption process.
C. Incorrect.
Incorrect: While restricting access using IAM policies is important for security, it does not encrypt the data at rest, which is a separate requirement.
D. Correct.
Correct: SSE-S3 provides server-side encryption managed by Amazon S3, which is a simple way to encrypt data at rest.
E. Incorrect.
Incorrect: AWS Secrets Manager is used for securely storing and managing secrets, such as API keys and passwords. It is not used to encrypt data directly in Amazon S3.

MLA-C01 Question 102

Select 2

You are designing a machine learning pipeline for a healthcare application that requires storing sensitive patient data in Amazon S3. Which of the following techniques can you use to ensure the data is encrypted both at rest and in transit?

A
Use Amazon S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) for data at rest and enable HTTPS for data in transit.
B
Use Amazon S3 Server-Side Encryption with a customer-provided key (SSE-C) and transfer data using unencrypted HTTP.
C
Use Amazon S3 Client-Side Encryption with AWS Key Management Service (KMS) for encryption and HTTPS for secure data transfer.
D
Enable Amazon S3 default bucket encryption and use Amazon S3 Transfer Acceleration for data in transit.
E
Store data in plaintext on Amazon S3 and use a Virtual Private Cloud (VPC) to secure access to data.

Show answer and explanation

Correct answers: A, C

Explanation

To protect sensitive data in a healthcare application, it is critical to encrypt data both at rest and in transit. Amazon S3 provides multiple options for encryption at rest, such as SSE-KMS and client-side encryption with AWS KMS. Additionally, enabling HTTPS ensures secure data transfer by encrypting data in transit. Options that fail to secure data in transit or store data in plaintext do not meet the requirements for protecting sensitive information.

A. Correct.
This is a correct option. Amazon S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) ensures data is encrypted at rest, and enabling HTTPS ensures the data is encrypted in transit.
B. Incorrect.
This is incorrect because transferring data using unencrypted HTTP does not secure data in transit, even though SSE-C encrypts data at rest.
C. Correct.
This is a correct option. Using Amazon S3 Client-Side Encryption with AWS KMS encrypts data before uploading, and HTTPS ensures secure transmission.
D. Incorrect.
This is incorrect because Amazon S3 Transfer Acceleration is used to speed up transfers and does not inherently encrypt data in transit. While default bucket encryption ensures data at rest is encrypted, it does not address encryption in transit.
E. Incorrect.
This is incorrect because storing data in plaintext does not encrypt it at rest, and using a VPC only secures network access but does not encrypt the data.

MLA-C01 Question 103

Select 3

You are tasked with designing a machine learning workflow on AWS that processes sensitive user data. To meet security requirements, you must encrypt the data at rest and in transit. Which techniques should you use to ensure compliance with AWS best practices for data encryption?

A
Use AWS Key Management Service (KMS) to manage encryption keys for encrypting data at rest.
B
Enable SSL/TLS for encrypting data in transit between services.
C
Store encryption keys in Amazon S3 for easy access during the workflow.
D
Use client-side encryption to encrypt data before uploading it to Amazon S3.
E
Rely solely on IAM roles and policies for securing sensitive data.

Show answer and explanation

Correct answers: A, B, D

Explanation

To ensure compliance with AWS best practices for encrypting sensitive data, you should use AWS KMS for managing encryption keys for data at rest, enable SSL/TLS for encrypting data in transit, and optionally use client-side encryption for added security. Storing encryption keys in Amazon S3 is not recommended due to potential security risks, and IAM roles and policies focus on access control rather than encryption.

A. Correct.
Correct. AWS KMS is the recommended service for managing encryption keys, and it integrates seamlessly with other AWS services for encrypting data at rest.
B. Correct.
Correct. SSL/TLS is the standard technique for encrypting data in transit, ensuring secure communication between services.
C. Incorrect.
Incorrect. Storing encryption keys in Amazon S3 is not a secure practice unless combined with proper encryption and access controls. AWS KMS is a more secure and recommended approach.
D. Correct.
Correct. Client-side encryption ensures that data is encrypted before being sent to AWS services, adding an additional layer of security.
E. Incorrect.
Incorrect. IAM roles and policies are crucial for access control but do not provide encryption for data at rest or in transit.

MLA-C01 Question 104

Select 3

You are building a machine learning pipeline on AWS that processes sensitive customer data. To ensure data security, you need to encrypt the data stored in Amazon S3 and while it is being transmitted between services. Which techniques should you use to meet these requirements?

A
Use AWS Key Management Service (KMS) to manage encryption keys for server-side encryption in S3.
B
Enable client-side encryption using a custom key stored in your on-premises environment.
C
Enable Amazon S3 default encryption with AES-256 encryption algorithm.
D
Use HTTPS to encrypt data in transit between services.
E
Enable S3 Transfer Acceleration for secure data transfer.

Show answer and explanation

Correct answers: A, C, D

Explanation

To secure sensitive data in both storage and transit, you need to implement encryption techniques. AWS KMS can manage server-side encryption keys for S3, and enabling default encryption with AES-256 ensures data at rest is secure. Additionally, HTTPS should be used to encrypt data in transit. While other options like client-side encryption or S3 Transfer Acceleration may provide some benefits, they are either unnecessary in this scenario or do not directly address encryption needs.

A. Correct.
Correct: AWS KMS integrates with S3 to provide server-side encryption with customer-managed keys, ensuring that data at rest is encrypted securely.
B. Incorrect.
Partially correct but not ideal: While client-side encryption is valid, managing custom keys on-premises increases complexity and risk. AWS services offer integrated encryption options that are easier to manage.
C. Correct.
Correct: Enabling default encryption with AES-256 ensures that all objects stored in S3 are encrypted at rest using a strong algorithm.
D. Correct.
Correct: HTTPS encrypts data in transit, ensuring that sensitive data is protected during transmission between services.
E. Incorrect.
Incorrect: S3 Transfer Acceleration is designed to speed up data transfers globally using optimized network paths, but it does not provide encryption.

MLA-C01 Question 105

Select 3

Your company is implementing a healthcare application that collects sensitive patient data. As an AWS Certified Machine Learning Engineer, you are tasked with ensuring that this data is protected while enabling the data to be used for training a machine learning model. Which of the following techniques should you use to achieve this goal?

A
Use AWS Glue DataBrew to mask personally identifiable information (PII) in the dataset.
B
Apply differential privacy techniques to anonymize the dataset.
C
Encrypt the dataset using AWS Key Management Service (KMS) and train the model directly on encrypted data.
D
Replace PII fields with synthetic data values using Amazon SageMaker Data Wrangler.
E
Perform data classification using Amazon Macie to identify and protect sensitive information.

Show answer and explanation

Correct answers: A, B, D

Explanation

To protect sensitive data for machine learning training, you can use data masking tools like AWS Glue DataBrew, anonymization techniques such as differential privacy, or replace sensitive fields with synthetic data. These techniques ensure compliance with data protection regulations while maintaining the dataset's usability. While Amazon Macie helps identify sensitive data, it does not implement masking or anonymization directly. Encrypting the dataset is important for security but does not make the data usable in its encrypted state for model training.

A. Correct.
AWS Glue DataBrew can be used to mask PII data, making it a suitable option for protecting sensitive information while still enabling its use for machine learning purposes.
B. Correct.
Differential privacy techniques add noise to the dataset, ensuring anonymity while maintaining its utility for training machine learning models. This is an effective method for protecting sensitive data.
C. Incorrect.
Encrypting the dataset with AWS KMS is a good security practice, but training a model directly on encrypted data is not feasible due to computational limitations and lack of model interpretability.
D. Correct.
Replacing PII fields with synthetic data values using Amazon SageMaker Data Wrangler ensures that sensitive information is removed while preserving the dataset's structure, making it useful for training purposes.
E. Incorrect.
Amazon Macie is a data classification service that identifies sensitive information, but it does not directly anonymize or mask the data. It is a precursor step rather than a standalone solution for this scenario.

Timed practice exam

Take a MLA-C01 practice test under exam conditions

65 questions in 130 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

MLA-C01 practice questions 101 to 200 of 457

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 5 pages of up to 100 questions.