MLS-C01 Question 352
Select 2You are deploying a machine learning model using Amazon SageMaker and need to ensure the traffic between the SageMaker endpoint and your data source, hosted on Amazon RDS, remains private without traversing the public internet. Which of the following steps should you take to achieve this?
- A
Deploy the SageMaker endpoint in a VPC subnet with appropriate route table settings.
- B
Ensure that the RDS instance is deployed in the same VPC as the SageMaker endpoint.
- C
Configure a VPC endpoint to enable private communication between SageMaker and RDS.
- D
Enable data encryption on the SageMaker endpoint and RDS instance.
- E
Use AWS Direct Connect to establish a dedicated private connection between SageMaker and RDS.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure private communication between the SageMaker endpoint and RDS without traversing the public internet, both services must be deployed in the same VPC. Deploying the SageMaker endpoint in a VPC subnet ensures it can communicate privately with the RDS instance. Additional configurations like VPC endpoints or Direct Connect are unnecessary in this scenario.
- A. Correct.
Correct: Deploying the SageMaker endpoint in a VPC subnet ensures that the endpoint can communicate privately with other resources in the same VPC without traversing the public internet.
- B. Correct.
Correct: Hosting the RDS instance in the same VPC as the SageMaker endpoint is necessary for private communication between the two services.
- C. Incorrect.
Incorrect: A VPC endpoint is not required for SageMaker to communicate with RDS if both are already in the same VPC.
- D. Incorrect.
Incorrect: Data encryption is a good practice but does not directly address the requirement for private communication.
- E. Incorrect.
Incorrect: AWS Direct Connect is used to establish a private connection between on-premises resources and AWS, not between two AWS services within a VPC.