MLS-C01 Question 345
Select 2You are building a machine learning inference application on AWS that uses an Amazon SageMaker endpoint to predict customer behavior. The endpoint is hosted in a private VPC, and your application needs to access it securely from an Amazon EC2 instance within the same VPC. Which of the following configurations must you implement in the security group associated with the SageMaker endpoint to ensure connectivity while maintaining security?
- A
Add an inbound rule allowing traffic from the EC2 instance's security group on the required port.
- B
Add an outbound rule allowing traffic to the EC2 instance's security group on the required port.
- C
Add an inbound rule allowing traffic from the EC2 instance's private IP address on the required port.
- D
Add an outbound rule allowing all traffic to 0.0.0.0/0.
- E
Remove the default outbound rule allowing all traffic.
Show answer and explanation
Correct answers: A, B
Explanation
In this scenario, the SageMaker endpoint's security group must be configured to allow inbound traffic from the EC2 instance's security group and outbound traffic back to the EC2 instance's security group to ensure bidirectional communication. Using security group references for both inbound and outbound rules is a best practice, as it facilitates scalable and secure communication within the VPC.
- A. Correct.
Correct: To allow the EC2 instance to communicate with the SageMaker endpoint, you must allow inbound traffic from the EC2 instance's security group in the SageMaker endpoint's security group.
- B. Correct.
Correct: Outbound rules are also required to allow the SageMaker endpoint to send responses to the EC2 instance. This must be configured in the SageMaker endpoint's security group.
- C. Incorrect.
Incorrect: While specifying the EC2 instance's private IP address might work, it is not a scalable or recommended practice, especially when using dynamic instances or autoscaling.
- D. Incorrect.
Incorrect: Allowing all traffic to 0.0.0.0/0 is a security risk and unnecessary. Security groups should always follow the principle of least privilege.
- E. Incorrect.
Incorrect: Removing the default outbound rule allowing all traffic is irrelevant in this scenario, as it would not impact internal VPC traffic. Default outbound rules are typically sufficient for this use case.