MLA-C01 Question 447
Select 3You are working as a machine learning engineer for a healthcare company that handles sensitive patient data. Your team is using Amazon SageMaker to train models on this data. To ensure security and compliance with healthcare regulations, which steps should you take when configuring your SageMaker environment?
- A
Enable encryption for data at rest by configuring an Amazon S3 bucket with server-side encryption using AWS KMS.
- B
Ensure that SageMaker notebooks and training jobs run within a private VPC with no internet access.
- C
Store sensitive patient data in the SageMaker notebook instance's local storage to ensure faster access.
- D
Use AWS Identity and Access Management (IAM) roles to control access to SageMaker resources and data.
- E
Disable CloudTrail logging to reduce unnecessary overhead when monitoring SageMaker activities.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure security and compliance in Amazon SageMaker when handling sensitive data, you should encrypt data at rest, isolate your environment within a private VPC, and use IAM roles to control access. These steps align with best practices for securing sensitive information and meeting compliance requirements. Storing sensitive data in local storage or disabling monitoring features like CloudTrail would create security risks and hinder the ability to audit activities.
- A. Correct.
Correct. Enabling encryption at rest using AWS KMS ensures that sensitive data stored in Amazon S3 is protected, which is a compliance requirement for many industries, including healthcare.
- B. Correct.
Correct. Running SageMaker notebooks and training jobs within a private VPC with no internet access helps secure the data and ensures compliance by limiting exposure to external networks.
- C. Incorrect.
Incorrect. Storing sensitive data in the local storage of a SageMaker notebook instance is not recommended as it is not as secure as Amazon S3 and lacks encryption or access control mechanisms.
- D. Correct.
Correct. Using IAM roles allows you to define fine-grained access controls for SageMaker resources and data, ensuring that only authorized entities can access sensitive information.
- E. Incorrect.
Incorrect. Disabling CloudTrail logging is not recommended as it prevents you from monitoring and auditing activities in the SageMaker environment, which is critical for maintaining security and compliance.