MLS-C01 Question 350
Select 2You are building a machine learning model that must process sensitive financial data. The model training occurs on Amazon SageMaker, and you need to ensure that all traffic between SageMaker and your Amazon S3 bucket, where your training data is stored, remains within the AWS network and does not traverse the public internet. How should you configure your environment to meet this requirement?
- A
Create a VPC endpoint for Amazon S3 and attach it to the VPC where SageMaker is deployed.
- B
Enable Amazon S3 Block Public Access and set the bucket policy to deny any requests from outside the VPC.
- C
Use a SageMaker notebook instance with direct internet access disabled and attach it to the same VPC where the VPC endpoint for S3 resides.
- D
Configure SageMaker to use an Elastic IP address for internet connectivity.
- E
Deploy a NAT gateway in the VPC to route SageMaker traffic securely to the S3 bucket.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure that traffic between SageMaker and S3 does not traverse the public internet, you must create a VPC endpoint for S3 and configure SageMaker to leverage it. Additionally, disabling direct internet access on the SageMaker instance and ensuring it operates within the same VPC as the S3 endpoint ensures that all communication is contained within the AWS private network. Other options either enhance security in different ways or introduce public internet access, which does not meet the requirement.
- A. Correct.
Creating a VPC endpoint for Amazon S3 ensures that traffic between SageMaker and the S3 bucket does not leave the AWS network, meeting the requirement to avoid public internet traversal.
- B. Incorrect.
Enabling S3 Block Public Access and setting bucket policies can improve security but does not address the requirement to ensure that traffic stays within the AWS network.
- C. Correct.
Using a SageMaker notebook instance with direct internet access disabled and attaching it to the same VPC as the S3 VPC endpoint ensures that communication remains private within the AWS network.
- D. Incorrect.
Configuring SageMaker to use an Elastic IP address does not ensure traffic remains within the AWS network; Elastic IP is intended for public internet-facing resources.
- E. Incorrect.
Deploying a NAT gateway routes traffic to the internet, which is not required in this scenario and does not meet the goal of avoiding public internet traversal.