MLA-C02 practice question: Network isolation and encryption (2 of 2)
Operating, Monitoring, and Securing ML and AI Solutions A free question from our original MLA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional bank runs a distributed SageMaker AI training job for a fraud model across several GPU instances in a private VPC. Its security policy requires the training volumes and the model output in S3 to be encrypted with customer managed AWS KMS keys, and the traffic between the training containers to be encrypted.
The team wants these controls set on the training job itself, using the training job configuration, with no changes to the training code.
Which combination of settings meets these requirements? (Choose three.)
Choose three answers.
AA. Set the training job's volume KMS key (VolumeKmsKeyId) to the customer managed key, so that the storage volumes attached to each training instance are encrypted with it.
BB. Set the training job's output KMS key (KmsKeyId in the output configuration) to the customer managed key, so that the model artifacts written to S3 are encrypted with it.
CC. Enable S3 versioning on the output bucket, which encrypts every object version with the customer managed key automatically.
DD. Turn on the default encryption of the account's EBS volumes, so that the training instance storage is encrypted with the AWS managed key.
EE. Turn on network isolation for the training job, which blocks the containers' outbound calls and encrypts the traffic between the training containers.
FF. Enable inter-container traffic encryption on the training job, and allow the required IPsec traffic in the VPC security group used by the job.
Show the answer and explanation
Answers: A, B, F
A. Right: Correct. VolumeKmsKeyId in the job's resource configuration names the KMS key that encrypts the storage volumes attached to the training instances. This meets the volume requirement in the job configuration. Learn more: ResourceConfig (VolumeKmsKeyId) (opens in a new tab)
B. Right: Correct. The KmsKeyId in the output data configuration is the key SageMaker AI uses to encrypt the model artifacts at rest in S3. The key policy must allow the job's execution role. Learn more: OutputDataConfig (KmsKeyId) (opens in a new tab)
C. Wrong: Versioning keeps previous object versions and does not select an encryption key for the artifacts. The option does not meet the KMS requirement.
D. Wrong: The stem asks for the customer managed key, and the AWS managed key does not meet the requirement. The option does not set the key on the training job.
E. Wrong: Network isolation blocks outbound network calls from the containers, but it does not encrypt the traffic between them. Inter-container traffic encryption is a separate training job setting.
On the training job, VolumeKmsKeyId encrypts the attached instance storage and the output KmsKeyId encrypts the model artifacts in S3 with the customer managed key, while inter-container traffic encryption protects data moving between instances. Versioning, account-level encryption with the AWS managed key and network isolation do not meet the customer managed key or traffic encryption requirements.
Want more on Network isolation and encryption? The 5 full-length practice sets have 10 more Network isolation and encryption questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →