MLA-C01 Question 429
Select 3You are building a machine learning pipeline on AWS to train a sensitive customer churn prediction model. The training data is stored in an Amazon S3 bucket. To secure your resources, you want to ensure that only the machine learning pipeline has access to the data and that the data is encrypted both at rest and in transit. Which of the following steps should you take to meet these requirements?
- A
Enable server-side encryption (SSE) with AWS Key Management Service (KMS) on the S3 bucket.
- B
Use an S3 bucket policy to allow access only to the IAM role associated with the machine learning pipeline.
- C
Enable S3 Transfer Acceleration to secure data in transit.
- D
Enable SSL/TLS for all connections to the S3 bucket.
- E
Grant public read permissions on the S3 bucket to simplify access for the pipeline.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure AWS resources for a machine learning pipeline, it is crucial to encrypt data both at rest and in transit, and to enforce strict access controls. Enabling SSE with AWS KMS ensures data at rest is encrypted, while using SSL/TLS secures data in transit. Additionally, an S3 bucket policy restricting access to the IAM role associated with the pipeline ensures that only authorized components can access the data. Avoid configurations like public read permissions, which compromise security.
- A. Correct.
Correct: Enabling SSE with AWS KMS ensures the data in the S3 bucket is encrypted at rest using a secure key management solution.
- B. Correct.
Correct: Using an S3 bucket policy to restrict access to only the IAM role associated with the machine learning pipeline ensures that no unauthorized entities can access the data.
- C. Incorrect.
Incorrect: S3 Transfer Acceleration is used to speed up uploads and downloads, not to secure data in transit.
- D. Correct.
Correct: Enabling SSL/TLS ensures that data is encrypted while being transmitted to and from the S3 bucket, preventing interception during transit.
- E. Incorrect.
Incorrect: Granting public read permissions would violate the security requirements and expose sensitive data to unauthorized access.