MLA-C01 Question 446
Select 3You are tasked with deploying a machine learning model using Amazon SageMaker. The model processes sensitive customer data, and your organization has strict compliance requirements, including encryption of data at rest and in transit. Which features of SageMaker should you implement to ensure security and compliance?
- A
Enable encryption of data stored in Amazon S3 using AWS Key Management Service (KMS).
- B
Use SageMaker model endpoints with network isolation (no internet access).
- C
Deploy the model using SageMaker Pipelines without specifying any role-based access control (RBAC).
- D
Enable HTTPS for data in transit to and from SageMaker endpoints.
- E
Store sensitive data on local storage to avoid using cloud services.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet security and compliance requirements, SageMaker provides features like encryption of data at rest using KMS, HTTPS for data in transit, and network isolation for endpoints to avoid internet exposure. These features ensure sensitive data is protected throughout the machine learning workflow. Avoiding these features or neglecting security configurations (e.g., RBAC) may result in non-compliance with organizational or regulatory standards.
- A. Correct.
Enabling encryption with AWS Key Management Service (KMS) ensures that data stored in Amazon S3 (used by SageMaker) is protected at rest, complying with security and compliance requirements.
- B. Correct.
Using SageMaker model endpoints with network isolation prevents the model from accessing the internet directly, enhancing security for sensitive data.
- C. Incorrect.
Deploying a model without specifying role-based access control (RBAC) is a poor practice that does not meet compliance requirements, as it could lead to unauthorized access.
- D. Correct.
Enabling HTTPS ensures that data in transit to and from SageMaker endpoints is encrypted, meeting compliance requirements for secure communication.
- E. Incorrect.
Storing sensitive data on local storage does not align with the requirements of using SageMaker, as it bypasses cloud-based compliance features like encryption and access control.