MLA-C01 Question 451
Select 2You are deploying a machine learning model on an Amazon SageMaker endpoint. To ensure secure network access, your organization requires that the endpoint is only accessible from specific IP ranges and that no public internet access is allowed. Which combination of configurations would meet these requirements?
- A
Configure a VPC with appropriate security group rules to allow access only from specific IP ranges.
- B
Enable public access for the SageMaker endpoint and use AWS WAF to restrict IP ranges.
- C
Attach an IAM policy to the SageMaker endpoint to enforce access from specific IP ranges.
- D
Disable 'Enable network access control' for the SageMaker endpoint and manage access through security groups.
- E
Deploy the SageMaker endpoint within a private subnet of a VPC.
Show answer and explanation
Correct answers: A, E
Explanation
To control network access to a SageMaker endpoint, deploying the endpoint in a private subnet within a VPC ensures it is isolated from the public internet. Additionally, security groups can be configured to restrict access to specific IP ranges. These configurations together meet the organization's security requirements.
- A. Correct.
This is correct. Configuring a VPC and security groups allows you to restrict access to the SageMaker endpoint to specific IP ranges, meeting the organization's requirements.
- B. Incorrect.
This is incorrect. Enabling public access exposes the endpoint to the internet, which violates the organization's requirement to disallow public internet access. AWS WAF is also not a recommended solution for this use case.
- C. Incorrect.
This is incorrect. IAM policies cannot enforce restrictions based on IP ranges for a SageMaker endpoint. IP-based restrictions are managed through network-level configurations like VPC and security groups.
- D. Incorrect.
This is incorrect. Disabling network access control removes additional layers of security and is contrary to the requirement for controlled access.
- E. Correct.
This is correct. Deploying the endpoint in a private subnet ensures it is not accessible from the public internet, which aligns with the organization's requirement to disallow public access.