MLA-C01 Question 88
Select 3A data scientist is training a machine learning model on Amazon SageMaker using a large dataset stored in Amazon S3. The dataset contains sensitive customer information, and the organization must ensure that data is encrypted both in transit and at rest. Additionally, the model training process should not expose the data to the public internet. Which of the following steps should the data scientist take to secure the data and meet the organization’s requirements?
- A
Use Amazon S3 bucket policies to enforce encryption at rest and require requests to use HTTPS.
- B
Enable Amazon SageMaker to use a VPC and configure a VPC endpoint for Amazon S3.
- C
Manually download the data to the SageMaker instance and ensure it is stored in an encrypted file system.
- D
Use AWS Key Management Service (KMS) to manage encryption keys for the S3 bucket storing the data.
- E
Configure SageMaker to directly access the S3 bucket without a VPC endpoint to simplify data transfer.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely train a machine learning model using sensitive data in SageMaker, it is essential to enforce encryption at rest and in transit, use VPC endpoints to prevent exposure to the public internet, and leverage AWS KMS for encryption key management. These steps ensure compliance with security requirements while minimizing the risk of data breaches.
- A. Correct.
Correct: Using S3 bucket policies to enforce encryption at rest and requiring HTTPS ensures data is protected from unauthorized access and is encrypted during transit.
- B. Correct.
Correct: Enabling SageMaker to use a VPC with a VPC endpoint for S3 ensures the data is accessed securely without exposing it to the public internet.
- C. Incorrect.
Incorrect: Manually downloading the data increases operational complexity and risk, and SageMaker provides better built-in mechanisms for securely accessing S3 data.
- D. Correct.
Correct: AWS KMS allows for secure management of encryption keys, ensuring encryption compliance for the sensitive data stored in S3.
- E. Incorrect.
Incorrect: Allowing SageMaker to access S3 without using a VPC endpoint exposes the data transfer to the public internet, violating the security requirements.