MLA-C02 practice question: Network isolation and encryption (1 of 2)

Operating, Monitoring, and Securing ML and AI Solutions A free question from our original MLA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

A dental chain trains a patient-risk model with a SageMaker AI training job on a bring-your-own container. The security team requires that the training container have no outbound network access during training, so that patient data cannot leave the job, and the input data is still provided to the job through its S3 input channels.

The team wants the isolation enforced by the SageMaker AI job setting, not by hoping the container code makes no calls.

Which setting should the team enable?

Choose one answer.

A. Attach a security group to the training job that denies all inbound traffic, since the container only needs outbound calls.
B. Remove the S3 input channels, and have the container download the data from a private internal API so that the job has fewer network paths.
C. Set the training job's network isolation option, so the container cannot make outbound calls, while SageMaker AI still copies inputs and uploads artifacts.
D. Disable the training job's logs in CloudWatch, since logs are the main way data can leave a training container.

Show the answer and explanation

Answer: C

A. Wrong: The option restricts inbound traffic, but the stem is about outbound calls from the container. Security groups alone do not enforce the no-outbound setting described.
B. Wrong: The stem requires the data to come through the S3 input channels, and downloading from inside the container adds the outbound access the team wants to block. The option works against the requirement.
C. Right: Correct. Network isolation blocks the container from outbound calls, and SageMaker AI itself still downloads the input channel data and uploads the model artifacts. The restriction is enforced by the job setting. Learn more: Run training and inference containers in internet-free mode (opens in a new tab)
D. Wrong: Logs are not the main path for data to leave the container, and disabling them does not enforce network isolation. The option also removes the team's visibility into the job.

Explanation

Network isolation on a SageMaker AI training job blocks the container's outbound network calls, while SageMaker AI still downloads the input data and uploads the artifacts. Inbound security groups, downloading data from inside the container and disabling logs do not enforce this outbound restriction.

MLA-C02 practice question: Network isolation and encryption (1 of 2)

Explanation

Study

Keep practicing