MLA-C01 Question 431
Select 2You are deploying a machine learning (ML) model on Amazon SageMaker and need to ensure that the inference endpoint is secure. The model processes sensitive customer data, so it is critical to enforce encryption in transit and restrict network access. Which actions should you take to secure the endpoint?
- A
Enable Amazon SageMaker endpoint encryption using an AWS Key Management Service (KMS) key.
- B
Configure the endpoint to only accept requests over HTTPS.
- C
Attach a security group to the endpoint that allows unrestricted inbound traffic.
- D
Use an AWS Identity and Access Management (IAM) policy to restrict access to the endpoint to specific IAM roles.
- E
Disable logging for the endpoint to prevent sensitive data from being recorded.
Show answer and explanation
Correct answers: B, D
Explanation
To secure an Amazon SageMaker endpoint that processes sensitive data, encryption in transit must be enforced by configuring the endpoint to accept only HTTPS traffic. Additionally, access should be restricted using IAM policies to ensure that only authorized entities can use the endpoint. These measures protect data confidentiality and meet security requirements.
- A. Incorrect.
Amazon SageMaker endpoint encryption using AWS KMS is for encrypting data at rest, not in transit. While securing data at rest is important, it does not address encryption in transit, which is a requirement here.
- B. Correct.
Configuring the endpoint to accept only HTTPS ensures that data transmitted to and from the endpoint is encrypted in transit, meeting the security requirement.
- C. Incorrect.
Allowing unrestricted inbound traffic to the endpoint exposes it to potential unauthorized access. Instead, traffic should be restricted to trusted sources.
- D. Correct.
Using an IAM policy to restrict access to specific IAM roles ensures that only authorized users or services can access the endpoint, enhancing its security.
- E. Incorrect.
Disabling logging does not improve security; instead, it reduces visibility into the endpoint's operations and security events, which is not recommended.