MLS-C01 Question 290
Select 3You are building a machine learning pipeline on AWS and are tasked with ensuring the solution adheres to AWS best practices for security and scalability. Your pipeline involves processing sensitive customer data stored in Amazon S3, training models using Amazon SageMaker, and deploying the models for real-time inference. Which of the following steps should you take to comply with AWS best practices?
- A
Enable server-side encryption (SSE) on the Amazon S3 bucket storing customer data.
- B
Use an Amazon SageMaker notebook instance with public access enabled for ease of collaboration.
- C
Leverage AWS Key Management Service (KMS) to manage encryption keys for sensitive data.
- D
Configure an IAM role with least privilege access for the SageMaker training job.
- E
Allow unrestricted internet access to your SageMaker endpoint for real-time inference.
Show answer and explanation
Correct answers: A, C, D
Explanation
To follow AWS best practices, you must ensure that sensitive data is encrypted both at rest and in transit, use IAM roles with least privilege to reduce the risk of unauthorized access, and manage encryption keys securely using AWS KMS. Public access to resources and unrestricted internet access should be avoided to uphold security and scalability standards.
- A. Correct.
Enabling server-side encryption (SSE) on Amazon S3 ensures that your sensitive data is encrypted at rest, which is a key AWS security best practice.
- B. Incorrect.
Using an Amazon SageMaker notebook instance with public access enabled exposes your environment to security risks, such as unauthorized access. This violates AWS security best practices.
- C. Correct.
AWS Key Management Service (KMS) provides centralized control over encryption keys, which helps secure sensitive data effectively and adheres to AWS security best practices.
- D. Correct.
Configuring an IAM role with least privilege ensures that the SageMaker training job has only the permissions it needs, aligning with AWS's security best practices.
- E. Incorrect.
Allowing unrestricted internet access to your SageMaker endpoint exposes the endpoint to potential attacks and is not recommended as per AWS best practices.