MLS-C01 Question 348
Select 2You are deploying a machine learning inference API on an EC2 instance within a private subnet of your VPC. To ensure the API is accessible only to a SageMaker notebook in the same VPC while maintaining security best practices, how should you configure the associated security group?
- A
Allow inbound traffic on the API's port from the SageMaker notebook's security group.
- B
Allow all inbound traffic from the SageMaker service IP range.
- C
Deny all outbound traffic from the EC2 instance's security group.
- D
Allow outbound traffic to the SageMaker notebook's security group.
- E
Allow inbound traffic only from trusted IP addresses outside the VPC.
Show answer and explanation
Correct answers: A, D
Explanation
To securely connect an EC2 instance hosting a machine learning inference API with a SageMaker notebook in the same VPC, you should configure the security group to allow inbound traffic from the SageMaker notebook's security group and outbound traffic to it. This configuration ensures secure, private communication while adhering to the principle of least privilege.
- A. Correct.
Correct. Allowing inbound traffic on the API's port from the SageMaker notebook's security group ensures secure communication between the EC2 instance and the SageMaker notebook without exposing the API to the public internet.
- B. Incorrect.
Incorrect. Allowing all inbound traffic from the SageMaker service IP range is overly permissive and violates security best practices. Security group rules should be as specific as possible.
- C. Incorrect.
Incorrect. Denying all outbound traffic from the EC2 instance's security group would prevent the EC2 instance from sending responses to the SageMaker notebook, breaking the functionality of the inference API.
- D. Correct.
Correct. Allowing outbound traffic to the SageMaker notebook's security group ensures that the EC2 instance can send responses to the notebook, completing the communication flow.
- E. Incorrect.
Incorrect. Allowing inbound traffic from trusted IP addresses outside the VPC is unnecessary for this use case and would expose the API to potential security risks.