MLA-C01 Question 449
Select 2A company uses Amazon SageMaker to build and train machine learning models. The company wants to ensure that access to the SageMaker notebook instances is restricted to specific IP ranges and that the training jobs only access datasets stored in Amazon S3 within a specific VPC. Which combination of controls should the company implement to meet these requirements?
- A
Configure a security group for the SageMaker notebook instances that allows inbound traffic only from the specified IP ranges.
- B
Use SageMaker lifecycle configurations to enforce network access restrictions.
- C
Set up a VPC endpoint for Amazon S3 and configure the SageMaker training jobs to use this VPC endpoint.
- D
Attach an IAM policy to the SageMaker notebook instances that restricts access to S3 buckets based on IP conditions.
- E
Enable network isolation mode for SageMaker training jobs.
Show answer and explanation
Correct answers: A, C
Explanation
To control network access to SageMaker resources, security groups should be used to restrict notebook instance access by IP ranges, and VPC endpoints should be configured to ensure training jobs access S3 datasets securely within a specific VPC. Lifecycle configurations, IAM policies, and network isolation mode do not directly address the network access requirements described in the scenario.
- A. Correct.
Correct: Configuring a security group for the SageMaker notebook instances ensures that only specified IP ranges can access the notebook, fulfilling the requirement to restrict access.
- B. Incorrect.
Incorrect: While lifecycle configurations can be used to customize notebook instance behavior, they are not used to enforce network access controls.
- C. Correct.
Correct: Setting up a VPC endpoint for Amazon S3 ensures that the training jobs access S3 datasets securely through the VPC, meeting the requirement to restrict access to a specific VPC.
- D. Incorrect.
Incorrect: IAM policies cannot enforce network restrictions based on IP addresses for SageMaker notebook instances. Security groups should be used instead.
- E. Incorrect.
Incorrect: Network isolation mode is used to ensure training jobs do not access the internet, but it does not control access to S3 datasets within a specific VPC.