AWS Certified Machine Learning Specialty · Free Practice Question Medium
Question 14
A healthcare analytics firm is leveraging Amazon SageMaker to train machine learning models on sensitive patient data. To comply with strict data privacy regulations, the training jobs are configured to run within a Virtual Private Cloud (VPC) that lacks direct internet access. What method should be employed to ensure these training jobs can securely access training data stored in an Amazon S3 bucket?
-
A
Use Direct Connect to establish a dedicated network connection from the VPC to S3 for secure data access.
-
B
Configure an Internet Gateway in the VPC for SageMaker to access S3 buckets over the internet.
-
C
Utilize VPC endpoints to allow direct, private connections to Amazon S3 from the VPC.
-
D
Establish a NAT Gateway in each subnet where SageMaker training jobs are run to enable S3 access.
Reveal correct answer
Correct answer: C
Explanation
Identify solutions that enable secure, private access to AWS services without requiring internet connectivity.
Correct Choice: Utilize VPC endpoints to allow direct, private connections to Amazon S3 from the VPC.
VPC endpoints facilitate secure and private communications between AWS services without traversing the public internet, making it the most suitable option for accessing S3 from a VPC without internet access. This aligns with AWS best practices for accessing S3 from private VPCs securely.
Incorrect Choice: Configure an Internet Gateway in the VPC for SageMaker to access S3 buckets over the internet.
Adding an Internet Gateway would provide internet access, violating the original premise of maintaining a VPC without internet connectivity for security reasons.
Incorrect Choice: Establish a NAT Gateway in each subnet where SageMaker training jobs are run to enable S3 access.
NAT Gateways are used to enable instances in a private subnet to initiate outbound traffic to the internet (or other AWS services), but they do not support inbound traffic and thus are not suitable for this scenario. They also indirectly imply accessing the internet, which contradicts the no-internet connectivity requirement.
Incorrect Choice: Use Direct Connect to establish a dedicated network connection from the VPC to S3 for secure data access.
AWS Direct Connect is used to establish a private connection between an on-premises network and AWS, not within AWS services. Moreover, it's more complex and not required for the scenario of accessing S3 from SageMaker within a VPC.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
