ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 189 - MLS-C01 discussion

Report
Export

A machine learning (ML) specialist wants to secure calls to the Amazon SageMaker Service API. The specialist has configured Amazon VPC with a VPC interface endpoint for the Amazon SageMaker Service API and is attempting to secure traffic from specific sets of instances and IAM users. The VPC is configured with a single public subnet.

Which combination of steps should the ML specialist take to secure the traffic? (Choose two.)

A.
Add a VPC endpoint policy to allow access to the IAM users.
Answers
A.
Add a VPC endpoint policy to allow access to the IAM users.
B.
Modify the users' IAM policy to allow access to Amazon SageMaker Service API calls only.
Answers
B.
Modify the users' IAM policy to allow access to Amazon SageMaker Service API calls only.
C.
Modify the security group on the endpoint network interface to restrict access to the instances.
Answers
C.
Modify the security group on the endpoint network interface to restrict access to the instances.
D.
Modify the ACL on the endpoint network interface to restrict access to the instances.
Answers
D.
Modify the ACL on the endpoint network interface to restrict access to the instances.
E.
Add a SageMaker Runtime VPC endpoint interface to the VPC.
Answers
E.
Add a SageMaker Runtime VPC endpoint interface to the VPC.
Suggested answer: C, E

Explanation:

To secure calls to the Amazon SageMaker Service API, the ML specialist should take the following steps:

Modify the security group on the endpoint network interface to restrict access to the instances. This will allow the ML specialist to control which instances in the VPC can communicate with the VPC interface endpoint for the Amazon SageMaker Service API.The security group can specify inbound and outbound rules based on the instance IDs, IP addresses, or CIDR blocks1.

Add a SageMaker Runtime VPC endpoint interface to the VPC. This will allow the ML specialist to invoke the SageMaker endpoints from within the VPC without using the public internet.The SageMaker Runtime VPC endpoint interface connects the VPC directly to the SageMaker Runtime using AWS PrivateLink2.

The other options are not as effective or necessary as the steps above. Adding a VPC endpoint policy to allow access to the IAM users is not required, as the IAM users can already access the Amazon SageMaker Service API through the VPC interface endpoint. Modifying the users' IAM policy to allow access to Amazon SageMaker Service API calls only is not sufficient, as it does not prevent unauthorized instances from accessing the VPC interface endpoint.Modifying the ACL on the endpoint network interface to restrict access to the instances is not possible, as network ACLs are associated with subnets, not network interfaces3.

References:

Security groups for your VPC - Amazon Virtual Private Cloud

Connect to SageMaker Within your VPC - Amazon SageMaker

Network ACLs - Amazon Virtual Private Cloud

asked 16/09/2024
Jason Hicks
44 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first