AWS Certified AI Practitioner · Free Practice Question Medium
Question 47
A financial analytics company has deployed a machine learning model using Amazon SageMaker within a Virtual Private Cloud (VPC) to analyze sensitive customer data. To meet security guidelines, the VPC is configured with no internet access. However, the model needs to regularly access and read data stored in Amazon S3. The company is looking for a solution that allows secure data transfer between the SageMaker model in the VPC and Amazon S3 without exposing data traffic to the public internet.
What do you recommend?
-
A
The company should use a VPC endpoint for Amazon S3 that allows secure, private connectivity between the VPC and Amazon S3, without the need for an internet connection, ensuring data is transferred securely within the AWS network
-
B
The company should use a NAT Gateway which enables outbound internet access for resources within the VPC to securely access Amazon S3
-
C
The company should use a SageMaker Inference endpoint that allows secure connectivity between the VPC and Amazon S3
-
D
The company should use an Internet Gateway, which provides a direct connection between the VPC and the internet, allowing data to be accessed from Amazon S3
Reveal correct answer
Correct answer: A
Explanation
Correct option:
The company should use a VPC endpoint for Amazon S3 that allows secure, private connectivity between the VPC and Amazon S3, without the need for an internet connection, ensuring data is transferred securely within the AWS network
A VPC endpoint for Amazon S3 is the most appropriate choice because it creates a private connection between the VPC and Amazon S3 over the AWS network, without requiring internet access. This VPC endpoint allows the SageMaker model deployed within the VPC to securely access data from Amazon S3 directly, using the internal AWS network paths. It provides enhanced security by keeping data traffic within the AWS infrastructure and not exposing it to the public internet.
You can use two types of VPC endpoints to access Amazon S3: gateway endpoints and interface endpoints (by using AWS PrivateLink). A gateway endpoint is a gateway that you specify in your route table to access Amazon S3 from your VPC over the AWS network. Interface endpoints extend the functionality of gateway endpoints by using private IP addresses to route requests to Amazon S3 from within your VPC, on premises, or from a VPC in another AWS Region by using VPC peering or AWS Transit Gateway.
Incorrect options:
The company should use an Internet Gateway, which provides a direct connection between the VPC and the internet, allowing data to be accessed from Amazon S3 - An Internet Gateway enables VPC resources to communicate with the internet, but it is not suitable in this scenario because the VPC does not have internet access, and the objective is to securely access S3 without exposing data traffic to the public internet. Using an Internet Gateway would not only require additional security configurations but also go against the company's requirement to avoid internet access.
The company should use a SageMaker Inference endpoint that allows secure connectivity between the VPC and Amazon S3 - A SageMaker Inference endpoint allows clients to invoke deployed models and receive predictions but does not serve the purpose of connecting a SageMaker model to Amazon S3. It is not designed to handle data access between the SageMaker model and S3, so it would not meet the company's requirement for secure data retrieval from S3 within a VPC.
The company should use a NAT Gateway which enables outbound internet access for resources within the VPC to securely access Amazon S3 - A NAT Gateway allows instances in a private subnet to access the internet, but it still routes traffic through the public internet, which may not align with the company's need for secure and private data transfer. Since the goal is to avoid internet access and maintain secure connectivity between the VPC and Amazon S3, a NAT Gateway is not the appropriate solution.
References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html
https://docs.aws.amazon.com/sagemaker/latest/dg/deploy-model.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
