MLS-C01 Question 351
Select 2You are deploying a machine learning model using Amazon SageMaker in a production environment. The model needs to process sensitive financial data and connect securely to data stored in Amazon S3. Additionally, the deployment must not allow any traffic over the public internet. Which of the following configurations will meet these requirements?
- A
Deploy the SageMaker endpoint in a private subnet within a VPC and configure a VPC endpoint for Amazon S3.
- B
Use a SageMaker endpoint with a public subnet and restrict access using a security group.
- C
Deploy the SageMaker endpoint in a private subnet and set up an AWS PrivateLink for Amazon S3.
- D
Enable network address translation (NAT) to allow the SageMaker endpoint to communicate with Amazon S3.
- E
Use an IAM role with fine-grained permissions to allow SageMaker access to Amazon S3.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirement of avoiding public internet traffic, the SageMaker endpoint must be deployed in a private subnet within a VPC. Additionally, to securely access Amazon S3, either a VPC endpoint or AWS PrivateLink can be configured. These options ensure that all communication remains within the AWS network and avoid any exposure to the public internet.
- A. Correct.
Correct: By deploying the SageMaker endpoint in a private subnet and configuring a VPC endpoint for Amazon S3, you ensure that all communication remains within the AWS network and no traffic goes over the public internet.
- B. Incorrect.
Incorrect: Using a public subnet allows internet access, which violates the requirement to avoid public internet traffic.
- C. Correct.
Correct: AWS PrivateLink can be used to create a secure, private connection between the SageMaker endpoint in a private subnet and Amazon S3 without using the public internet.
- D. Incorrect.
Incorrect: A NAT gateway or instance would send traffic through the public internet, which does not meet the requirement to avoid public internet traffic.
- E. Incorrect.
Incorrect: While an IAM role is necessary for SageMaker to access S3 securely, it does not address the requirement to prevent traffic from going over the public internet.