MLA-C01 Question 444
Select 2An organization is using Amazon SageMaker to train machine learning models on sensitive financial data. They want to ensure the data is encrypted during training and that all actions taken on the SageMaker platform are logged for auditing purposes. Which combination of SageMaker features can be used to meet these requirements?
- A
Enable encryption of data at rest using AWS Key Management Service (KMS).
- B
Use SageMaker Network Isolation to isolate the training jobs from the internet.
- C
Enable VPC endpoints to secure communication between SageMaker and other AWS services.
- D
Enable AWS CloudTrail logging to capture API activity for SageMaker.
- E
Use SageMaker Multi-Model Endpoints to serve multiple models from a single endpoint.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure compliance with security and auditing requirements, sensitive data should be encrypted both at rest and in transit. Amazon SageMaker supports encryption of data at rest using AWS KMS, which protects sensitive data during training. Additionally, enabling AWS CloudTrail provides comprehensive logging of API activity in SageMaker, which is critical for auditing purposes.
- A. Correct.
Correct. Enabling encryption of data at rest using AWS KMS ensures that the sensitive financial data used in training is protected while stored.
- B. Incorrect.
Incorrect. While SageMaker Network Isolation is a useful security feature to prevent external internet access during training, it does not address encryption or logging requirements in this scenario.
- C. Incorrect.
Incorrect. Enabling VPC endpoints secures communication between SageMaker and other AWS services but does not directly address data encryption or logging for auditing.
- D. Correct.
Correct. Enabling AWS CloudTrail logs all API activity, which provides the required auditing capability for all actions taken on SageMaker.
- E. Incorrect.
Incorrect. SageMaker Multi-Model Endpoints are used for serving multiple models from a single endpoint and do not address encryption or logging requirements.