ExamPark
Course menuMLA-C02

Exams / MLA-C02 / Auditing and pipeline security / Question 1

MLA-C02 practice question: Auditing and pipeline security

Operating, Monitoring, and Securing ML and AI Solutions A free question from our original MLA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A pet insurer requires an audit trail for its SageMaker AI model governance. Auditors need to see who changed the approval status of a model package in the Model Registry, and who read the training data files that the team stores in a restricted S3 bucket.

The security team wants these events recorded with AWS CloudTrail and kept for review, with no custom logging code in the ML workflows.

Which TWO CloudTrail configurations meet these requirements? (Choose two.)

Choose two answers.

  1. A. Keep CloudTrail management events enabled in a trail, so that SageMaker AI control plane calls such as the model package update are recorded with the caller's identity.
  2. B. Turn on the S3 object-level data events for the restricted bucket in the trail, so that each read of a training data object is recorded with its caller.
  3. C. Turn on S3 server access logging for the training data bucket, and assume it is also the way to record SageMaker AI approval changes.
  4. D. Enable CloudWatch Logs on the notebook instances, since notebook logs record every call the data scientists make to any AWS service.
  5. E. Use AWS Config to record the approval status of model packages as configuration items, which shows each change with the identity that made it.
Show the answer and explanation

Answers: A, B

  • A. Right: Correct. Management events record control plane API calls, including SageMaker AI actions such as updating a model package. The trail records who made each call. Learn more: Logging SageMaker AI API calls with CloudTrail (opens in a new tab)
  • B. Right: Correct. S3 object-level operations such as GetObject are CloudTrail data events, which trails do not log by default. Enabling data events for the restricted bucket records each read with the caller's identity. Learn more: Enabling CloudTrail event logging for S3 buckets and objects (opens in a new tab)
  • C. Wrong: Server access logs cover S3 requests, but they do not record SageMaker AI approval changes. The option misses the model package audit requirement.
  • D. Wrong: Notebook logs cover what runs on the instance and not every API call made to AWS, and they do not capture the registry approval change. The option does not give the audit trail.
  • E. Wrong: AWS Config records resource configuration changes, but it does not record the identity of the caller in the way CloudTrail does for API calls. The S3 read events are also outside its scope.

Explanation

CloudTrail management events record SageMaker AI control plane calls such as a model package approval update, and S3 object-level data events record reads of objects in the restricted bucket. Server access logs, notebook logs and AWS Config do not capture both the registry change and the caller identity for the object reads.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free MLA-C02 practice examPractice Auditing and pipeline securityAll Auditing and pipeline security questions

Want more on Auditing and pipeline security? The 5 full-length practice sets have 11 more Auditing and pipeline security questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets