MLS-C01 Question 349
Select 3You are deploying a machine learning model on Amazon SageMaker and need to ensure that the model endpoint is only accessible from your organization's on-premises network through a secure connection. Which of the following steps should you take to meet this requirement?
- A
Deploy the SageMaker endpoint in a private subnet within your Amazon VPC.
- B
Configure a VPC endpoint for SageMaker in your VPC.
- C
Use AWS Direct Connect or a VPN connection to establish a secure link between your on-premises network and the VPC.
- D
Attach an internet gateway to the VPC where the SageMaker endpoint is deployed.
- E
Configure IAM policies to restrict access to the SageMaker endpoint to specific IP addresses.
Show answer and explanation
Correct answers: A, B, C
Explanation
To ensure the SageMaker endpoint is only accessible from your on-premises network, you must deploy it in a private subnet and use a VPC endpoint to keep communication within the VPC. Additionally, you need a secure connection, such as AWS Direct Connect or a VPN, to link your on-premises network to the VPC. An internet gateway or IAM policies alone cannot meet the requirement for secure, private access.
- A. Correct.
Correct: Deploying the SageMaker endpoint in a private subnet ensures that it is not directly accessible from the internet.
- B. Correct.
Correct: A VPC endpoint allows SageMaker to communicate securely within the VPC without requiring internet access.
- C. Correct.
Correct: AWS Direct Connect or a VPN connection provides a secure connection between your on-premises network and the VPC, enabling private access to the SageMaker endpoint.
- D. Incorrect.
Incorrect: An internet gateway allows public internet access to resources in the VPC, which contradicts the requirement for secure, private access.
- E. Incorrect.
Incorrect: IAM policies alone cannot enforce secure network-level restrictions or ensure private access from the on-premises network.