ExamPark
Course menuMLA-C02

Exams / MLA-C02 / Study guide / Containers and endpoints in a VPC

Containers and endpoints in a VPC: MLA-C02 study notes and practice questions

What to know about Containers and endpoints in a VPC for the MLA-C02 exam, from the Deployment and Orchestration of ML and AI Workflows domain (24% of the exam guide), then 1 free question to test it. Part of the MLA-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

These questions ask how to host a custom model container, or how to keep an endpoint’s traffic private.

Containers

  • Prebuilt images for frameworks (PyTorch, TensorFlow, scikit-learn, XGBoost, Hugging Face, LMI) cover most needs.
  • Custom images are stored in Amazon ECR. A serving container must respond to /ping (health) and /invocations (predictions) on port 8080.
  • Inference code in script mode (inference.py with model loading and predict functions) avoids building an image.
  • Multi-container and inference pipeline endpoints chain containers.

Endpoints and jobs in a VPC

  • Specify subnets and security groups in the model’s or job’s VPC config. SageMaker AI creates ENIs in your subnets.
  • With no internet gateway or NAT, add VPC endpoints for what the container needs:
    • S3 gateway endpoint for model artifacts and data
    • ECR (api and dkr) interface endpoints for images
    • SageMaker API and Runtime interface endpoints for clients in the VPC
    • CloudWatch Logs, STS and KMS as needed
  • Endpoint policies and bucket policies with aws:SourceVpce restrict access further.
  • Clients call InvokeEndpoint through the SageMaker Runtime interface endpoint, so calls stay on the AWS network.

Network isolation

Network isolation on a model or training job blocks all outbound calls from the container, while SageMaker AI still downloads artifacts and data for it.

Studio and notebooks

SageMaker Studio domains can run in VPC only mode; then the same endpoints are needed for Studio to reach AWS services.

Common traps

  • A NAT gateway to reach S3 and SageMaker APIs when VPC endpoints keep traffic private.
  • Forgetting ECR endpoints, so the endpoint can’t pull its image.
  • Expecting a security group to stop the container’s outbound calls completely. Use network isolation.

Try the 1 practice question

Practice Containers and endpoints in a VPCTake the free practice exam

Question 1

Harder ·Link to this question (question 1)

A dental chain hosts a patient-risk model on a SageMaker AI endpoint. Its security team requires that the endpoint and the model artifacts stay inside a VPC with no internet gateway or NAT, and that clinic applications invoke the endpoint only over the private network.

The endpoint must read its model artifact from S3 and its container image from Amazon ECR, and the applications run in the same VPC in private subnets.

Which configuration meets these requirements?

Choose one answer.

  1. A. Create the endpoint outside the VPC, and let the applications call it through the public endpoint with an IAM policy that restricts the source addresses.
  2. B. Place the endpoint in private subnets with a VPC configuration, and create VPC endpoints for the SageMaker runtime, S3 and ECR so traffic stays private.
  3. C. Add a NAT gateway to the private subnets so that the endpoint can reach S3 and ECR through the internet, and keep the rest of the design unchanged.
  4. D. Copy the model artifact and container image into a Lambda function package, and invoke the Lambda function from the applications instead of an endpoint.
Show the answer and explanation

Answer: B

  • A. Wrong: An endpoint outside the VPC is reached over the public network, which the security team ruled out. An IAM policy does not keep the traffic private.
  • B. Right: Correct. A VPC configuration places the endpoint in the private subnets, and VPC endpoints let it reach S3 and ECR, and let the applications call the SageMaker runtime, without internet access. This keeps all traffic on the private network. Learn more: Give SageMaker AI hosted endpoints access to resources in your VPC (opens in a new tab)
  • C. Wrong: A NAT gateway gives the subnets internet access, which the security team forbids. The stem requires no internet gateway or NAT.
  • D. Wrong: The stem requires a SageMaker AI endpoint, and a Lambda package is not suited to a large model. The option replaces the hosting design instead of configuring it.

Explanation

A SageMaker AI endpoint can be placed in private VPC subnets, and VPC endpoints for the SageMaker runtime, S3 and ECR keep its traffic on the AWS network, so no internet gateway or NAT is needed. Outside-VPC endpoints and NAT gateways both use the public network, and a Lambda package does not replace the endpoint.

Study

Want more on Containers and endpoints in a VPC? The 5 full-length practice sets have 8 more Containers and endpoints in a VPC questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Containers and endpoints in a VPC

More Deployment and Orchestration of ML and AI Workflows topics