MLA-C01 Question 430
Single answerAn organization is deploying a machine learning model using Amazon SageMaker and wants to ensure that the deployed endpoint is secure. The team must prevent unauthorized access to the endpoint while allowing legitimate requests from specific applications hosted within the same VPC. Which solution will best meet this requirement?
- A
Attach an IAM policy to the SageMaker endpoint to allow access only to specific IAM roles.
- B
Deploy the SageMaker endpoint in a private VPC and use a VPC endpoint for communication.
- C
Enable AWS WAF (Web Application Firewall) on the SageMaker endpoint to restrict access based on IP addresses.
- D
Encrypt the SageMaker endpoint traffic using an SSL certificate to secure communication.
Show answer and explanation
Correct answer: B
Explanation
The most secure solution to restrict access to a SageMaker endpoint while allowing legitimate access from specific applications in the same VPC is to deploy the endpoint in a private VPC and use a VPC endpoint. This approach ensures that the endpoint is isolated from public access and only accessible via resources within the VPC. IAM policies, SSL encryption, and AWS WAF do not directly address the requirement to restrict endpoint access based on network boundaries.
- A. Incorrect.
IAM policies are used to control access to AWS resources based on user or role permissions, but they do not restrict access based on network boundaries or VPCs. This option does not fully secure the endpoint against unauthorized network access.
- B. Correct.
Deploying the SageMaker endpoint in a private VPC and using a VPC endpoint ensures that access to the endpoint is restricted to resources within the VPC. This is the most secure solution for preventing unauthorized access while allowing legitimate communication from specific applications in the VPC.
- C. Incorrect.
AWS WAF is used to filter and monitor HTTP/HTTPS requests to web applications, but it is not directly applicable to securing a SageMaker endpoint in this scenario. It does not enforce VPC-based restrictions.
- D. Incorrect.
Encrypting traffic with SSL ensures secure communication but does not restrict access to the SageMaker endpoint. While important for secure data transmission, it does not fulfill the requirement to prevent unauthorized access.