MLA-C01 Question 450
Select 2You are managing a machine learning model hosted on Amazon SageMaker. To ensure secure access to the model endpoint, you need to implement controls for network access. Your organization requires that only internal resources within a specific VPC can access this endpoint. Which configuration steps should you take to meet these requirements?
- A
Create a VPC endpoint for SageMaker and associate it with your VPC.
- B
Modify the SageMaker endpoint configuration to enable network isolation mode.
- C
Attach a security group to the SageMaker endpoint that allows traffic only from the required VPC CIDR block.
- D
Use an IAM policy to restrict access to the SageMaker endpoint to specific IAM roles.
- E
Enable public access for the SageMaker endpoint but restrict traffic using a WAF (Web Application Firewall).
Show answer and explanation
Correct answers: A, C
Explanation
To ensure the SageMaker model endpoint is only accessible from internal resources within a specific VPC, you need to configure a VPC endpoint and attach a security group that restricts traffic to the VPC CIDR block. These steps secure both the network path and access to the endpoint, fulfilling the organization's requirements. Network isolation mode and IAM policies are not sufficient on their own for controlling network-level access, and enabling public access contradicts the security objective.
- A. Correct.
Creating a VPC endpoint for SageMaker allows your resources within the specific VPC to securely communicate with SageMaker without traversing the public internet. This is a necessary step to restrict access to internal resources.
- B. Incorrect.
Network isolation mode is used to prevent SageMaker training jobs or endpoints from accessing the internet, but it does not control network access to the SageMaker endpoint itself.
- C. Correct.
Attaching a security group with rules that restrict traffic to the required VPC CIDR block ensures that only resources within the VPC can access the SageMaker endpoint.
- D. Incorrect.
IAM policies manage user or role-level access but do not control network-level access. This alone would not restrict access to specific VPC resources.
- E. Incorrect.
Enabling public access for the SageMaker endpoint contradicts the requirement to restrict access to internal resources and is not a recommended practice for securing sensitive ML endpoints.