MLS-C01 Question 334
Select 3A data science team is building an ML solution on AWS to process sensitive customer data. The team uses Amazon SageMaker for training and inference and stores the data in Amazon S3. To comply with organizational security policies, the team must ensure that data is encrypted at rest and in transit, and that access to the ML solution is restricted to authorized users only. Which combination of actions should the team take to meet these requirements?
- A
Enable server-side encryption (SSE) for the Amazon S3 buckets used to store the data.
- B
Use an AWS Key Management Service (KMS) key to encrypt data stored in Amazon S3 and configure SageMaker to use the same KMS key.
- C
Enable SageMaker notebook instances to be accessed via public IPs for easier collaboration.
- D
Use AWS Identity and Access Management (IAM) policies to restrict access to SageMaker resources and S3 buckets to authorized users.
- E
Enable Amazon S3 Transfer Acceleration to secure data in transit between SageMaker and S3.
Show answer and explanation
Correct answers: A, B, D
Explanation
To apply basic AWS security practices to an ML solution, data must be encrypted at rest and in transit, and access should be restricted to authorized users. Enabling server-side encryption for S3 and using KMS keys ensure data is encrypted at rest. Using IAM policies restricts access to authorized users. Avoiding public IPs for SageMaker and ensuring secure communication protocols (e.g., HTTPS) are essential to maintain security. Transfer Acceleration is not relevant to this scenario as it is focused on performance, not security.
- A. Correct.
This option is correct because enabling server-side encryption ensures that data stored in S3 is encrypted at rest, which is a basic AWS security best practice.
- B. Correct.
This option is correct because using AWS KMS to manage encryption keys provides an additional layer of control and security over how data is encrypted and decrypted.
- C. Incorrect.
This option is incorrect because enabling public IPs for SageMaker notebook instances increases the attack surface and violates basic security practices.
- D. Correct.
This option is correct because IAM policies are a foundational tool to restrict access to AWS resources, ensuring only authorized users can access the ML solution.
- E. Incorrect.
This option is incorrect because Amazon S3 Transfer Acceleration is designed to improve data transfer speed, not specifically to secure data in transit. To secure data in transit, you would use encryption protocols like HTTPS or TLS.