MLA-C02 practice question: Containers and endpoints in a VPC

Deployment and Orchestration of ML and AI Workflows A free question from our original MLA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

A dental chain hosts a patient-risk model on a SageMaker AI endpoint. Its security team requires that the endpoint and the model artifacts stay inside a VPC with no internet gateway or NAT, and that clinic applications invoke the endpoint only over the private network.

The endpoint must read its model artifact from S3 and its container image from Amazon ECR, and the applications run in the same VPC in private subnets.

Which configuration meets these requirements?

Choose one answer.

A. Create the endpoint outside the VPC, and let the applications call it through the public endpoint with an IAM policy that restricts the source addresses.
B. Place the endpoint in private subnets with a VPC configuration, and create VPC endpoints for the SageMaker runtime, S3 and ECR so traffic stays private.
C. Add a NAT gateway to the private subnets so that the endpoint can reach S3 and ECR through the internet, and keep the rest of the design unchanged.
D. Copy the model artifact and container image into a Lambda function package, and invoke the Lambda function from the applications instead of an endpoint.

Show the answer and explanation

Answer: B

A. Wrong: An endpoint outside the VPC is reached over the public network, which the security team ruled out. An IAM policy does not keep the traffic private.
B. Right: Correct. A VPC configuration places the endpoint in the private subnets, and VPC endpoints let it reach S3 and ECR, and let the applications call the SageMaker runtime, without internet access. This keeps all traffic on the private network. Learn more: Give SageMaker AI hosted endpoints access to resources in your VPC (opens in a new tab)
C. Wrong: A NAT gateway gives the subnets internet access, which the security team forbids. The stem requires no internet gateway or NAT.
D. Wrong: The stem requires a SageMaker AI endpoint, and a Lambda package is not suited to a large model. The option replaces the hosting design instead of configuring it.

Explanation

A SageMaker AI endpoint can be placed in private VPC subnets, and VPC endpoints for the SageMaker runtime, S3 and ECR keep its traffic on the AWS network, so no internet gateway or NAT is needed. Outside-VPC endpoints and NAT gateways both use the public network, and a Lambda package does not replace the endpoint.

MLA-C02 practice question: Containers and endpoints in a VPC

Explanation

Study

Keep practicing