MLS-C01 Question 335
Select 4You are developing a machine learning solution for your organization using Amazon SageMaker. The model training involves sensitive customer data. To comply with your organization’s security policies, you must ensure that all data used in the training process is encrypted at rest and in transit. Additionally, you need to limit access to the SageMaker resources to only the specific IAM roles required for the workflow. Which combination of actions will meet these requirements?
- A
Enable Amazon S3 server-side encryption (SSE) for the input data and output data used by SageMaker.
- B
Use AWS Key Management Service (AWS KMS) to encrypt the SageMaker training jobs and models at rest.
- C
Ensure that all SageMaker API requests are made over HTTPS.
- D
Attach a full-access AmazonSageMakerFullAccess policy to all IAM users in the account.
- E
Set up an IAM policy to restrict access to SageMaker resources to only the specific roles required for the workflow.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To apply basic AWS security practices to ML solutions, it is essential to encrypt data both at rest and in transit and to enforce access control using the principle of least privilege. Enabling S3 server-side encryption and using AWS KMS for encrypting SageMaker resources ensure data encryption at rest. Requiring HTTPS for API requests ensures data encryption in transit. Restricting access to SageMaker resources to only the necessary IAM roles minimizes the risk of unauthorized access. Avoid granting overly broad permissions, as this goes against AWS security best practices.
- A. Correct.
Enabling Amazon S3 server-side encryption ensures that all input and output data stored in S3 buckets is encrypted at rest, meeting a key security requirement.
- B. Correct.
Using AWS KMS for encryption ensures that the SageMaker training jobs and models are encrypted at rest using a managed key, providing data protection.
- C. Correct.
Ensuring all SageMaker API requests are made over HTTPS encrypts the data in transit, maintaining security during communication with SageMaker.
- D. Incorrect.
Attaching the AmazonSageMakerFullAccess policy to all IAM users is not a best practice, as it grants excessive permissions beyond what is minimally required, violating the principle of least privilege.
- E. Correct.
Setting up an IAM policy to restrict access to SageMaker resources ensures that only the roles required for the workflow have access, aligning with best security practices.