MLS-C01 Question 333
Select 4You are building an ML solution on AWS to analyze sensitive customer data. The solution includes using Amazon SageMaker for training and inference. To comply with your organization's security policies, which require encryption of data at rest and in transit, as well as fine-grained access control, which of the following actions should you take to meet these requirements?
- A
Enable encryption for the Amazon S3 buckets used to store training data and model artifacts.
- B
Use AWS Key Management Service (KMS) to manage encryption keys for SageMaker resources.
- C
Ensure SageMaker notebooks and endpoints use HTTPS for data transmission.
- D
Attach an IAM policy to SageMaker roles that allows unrestricted access to all S3 buckets.
- E
Enable network isolation mode (NIM) for SageMaker training jobs and endpoints.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To apply basic AWS security practices to your ML solution, you need to ensure data is encrypted both at rest and in transit, restrict access to resources using fine-grained IAM policies, and minimize network exposure where possible. Options 1, 2, 3, and 5 collectively achieve this by encrypting data, managing encryption keys securely, securing data transmission with HTTPS, and enabling network isolation for SageMaker resources.
- A. Correct.
Correct: Encrypting the Amazon S3 buckets where training data and model artifacts are stored ensures data at rest is protected, which is a basic AWS security best practice.
- B. Correct.
Correct: Using AWS KMS to manage encryption keys provides fine-grained control over who can access and manage the keys, ensuring compliance with organizational security policies.
- C. Correct.
Correct: HTTPS ensures data is encrypted during transmission, protecting data in transit and meeting security requirements for sensitive data.
- D. Incorrect.
Incorrect: Allowing unrestricted access to all S3 buckets violates the principle of least privilege and is not a recommended security practice.
- E. Correct.
Correct: Enabling network isolation mode ensures that the SageMaker training jobs and endpoints do not have direct access to the internet, adding an additional layer of security.