Amazon AWS Certified Machine Learning Engineer - Associate MLA-C01 Exam Dumps, Practice Test Questions

This action is appropriate for another requirement: An ML data bucket must reject client uploads that do not request the approved server-side encryption mode even though S3 default encryption exists. It does not solve the presented constraint: A central data account holds training data, and a separate ML account requires only read access to one approved S3 prefix for scheduled training. The matching action for this case is: Use a narrowly trusted cross-account IAM role and matching bucket and key permissions.

This action is appropriate for another requirement: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. It does not solve the presented constraint: A central data account holds training data, and a separate ML account requires only read access to one approved S3 prefix for scheduled training. The matching action for this case is: Use a narrowly trusted cross-account IAM role and matching bucket and key permissions.

This action is appropriate for another requirement: A private application in an AWS VPC should be the only workload able to reach a prediction proxy, but its current security group allows TCP traffic from every CIDR. It does not solve the presented constraint: A central data account holds training data, and a separate ML account requires only read access to one approved S3 prefix for scheduled training. The matching action for this case is: Use a narrowly trusted cross-account IAM role and matching bucket and key permissions.

This action is appropriate for another requirement: An ML data bucket must reject client uploads that do not request the approved server-side encryption mode even though S3 default encryption exists. It does not solve the presented constraint: A bank enables data capture for inference troubleshooting but must protect captured request bodies and limit who can read the resulting S3 objects. The matching action for this case is: Encrypt captured request and response artifacts in S3 and restrict the designated investigation role.

This action is appropriate for another requirement: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. It does not solve the presented constraint: A bank enables data capture for inference troubleshooting but must protect captured request bodies and limit who can read the resulting S3 objects. The matching action for this case is: Encrypt captured request and response artifacts in S3 and restrict the designated investigation role.

This action is appropriate for another requirement: A private application in an AWS VPC should be the only workload able to reach a prediction proxy, but its current security group allows TCP traffic from every CIDR. It does not solve the presented constraint: A bank enables data capture for inference troubleshooting but must protect captured request bodies and limit who can read the resulting S3 objects. The matching action for this case is: Encrypt captured request and response artifacts in S3 and restrict the designated investigation role.

This action is appropriate for another requirement: An ML deployment pipeline pulls a custom container image containing a known vulnerable package and security wants the image rejected before production. It does not solve the presented constraint: A CodeBuild project used in an ML pipeline has permission to update production SageMaker endpoints even though its only job is to run tests and publish a container image. The matching action for this case is: Restrict CodeBuild's role to build-related resource actions and move deployment privileges to a separate release role.

This action is appropriate for another requirement: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. It does not solve the presented constraint: A CodeBuild project used in an ML pipeline has permission to update production SageMaker endpoints even though its only job is to run tests and publish a container image. The matching action for this case is: Restrict CodeBuild's role to build-related resource actions and move deployment privileges to a separate release role.

This action is appropriate for another requirement: A company needs evidence that S3 buckets holding ML training data remain free of public access and that changes are flagged after initial deployment. It does not solve the presented constraint: A CodeBuild project used in an ML pipeline has permission to update production SageMaker endpoints even though its only job is to run tests and publish a container image. The matching action for this case is: Restrict CodeBuild's role to build-related resource actions and move deployment privileges to a separate release role.

This action is appropriate for another requirement: A central data account holds training data, and a separate ML account requires only read access to one approved S3 prefix for scheduled training. It does not solve the presented constraint: A private application in an AWS VPC should be the only workload able to reach a prediction proxy, but its current security group allows TCP traffic from every CIDR. The matching action for this case is: Limit the proxy security group ingress to authorized application security groups or subnet boundaries.

This action is appropriate for another requirement: A regulated organization stores model artifacts in S3 and requires auditable control over which deployment roles can decrypt them. It does not solve the presented constraint: A private application in an AWS VPC should be the only workload able to reach a prediction proxy, but its current security group allows TCP traffic from every CIDR. The matching action for this case is: Limit the proxy security group ingress to authorized application security groups or subnet boundaries.

This action is appropriate for another requirement: A SageMaker training job was given administrator-level permissions, though it only needs one S3 training prefix and a KMS key. It does not solve the presented constraint: A private application in an AWS VPC should be the only workload able to reach a prediction proxy, but its current security group allows TCP traffic from every CIDR. The matching action for this case is: Limit the proxy security group ingress to authorized application security groups or subnet boundaries.

This action is appropriate for another requirement: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. It does not solve the presented constraint: A company needs evidence that S3 buckets holding ML training data remain free of public access and that changes are flagged after initial deployment. The matching action for this case is: Enable an appropriate AWS Config rule and notifications for ongoing bucket configuration checks.

This action is appropriate for another requirement: An ML data bucket must reject client uploads that do not request the approved server-side encryption mode even though S3 default encryption exists. It does not solve the presented constraint: A company needs evidence that S3 buckets holding ML training data remain free of public access and that changes are flagged after initial deployment. The matching action for this case is: Enable an appropriate AWS Config rule and notifications for ongoing bucket configuration checks.

This action is appropriate for another requirement: A CodeBuild project used in an ML pipeline has permission to update production SageMaker endpoints even though its only job is to run tests and publish a container image. It does not solve the presented constraint: A company needs evidence that S3 buckets holding ML training data remain free of public access and that changes are flagged after initial deployment. The matching action for this case is: Enable an appropriate AWS Config rule and notifications for ongoing bucket configuration checks.

That alternative addresses a different task: Security operations detects unexpected calls to model-management APIs and needs immutable audit evidence identifying the AWS principal and originating source. The selected workloads instead require Scoped SageMaker execution permissions, Rotate model API secrets, Encrypted captured inference records.

That alternative addresses a different task: A regulated organization stores model artifacts in S3 and requires auditable control over which deployment roles can decrypt them. The selected workloads instead require Scoped SageMaker execution permissions, Rotate model API secrets, Encrypted captured inference records.

That alternative addresses a different task: A private application in an AWS VPC should be the only workload able to reach a prediction proxy, but its current security group allows TCP traffic from every CIDR. The selected workloads instead require Scoped SageMaker execution permissions, Rotate model API secrets, Encrypted captured inference records.

That alternative addresses a different task: A central data account holds training data, and a separate ML account requires only read access to one approved S3 prefix for scheduled training. The selected workloads instead require Reject unencrypted data uploads, Trace unauthorized endpoint calls, Least privilege build stage.

That alternative addresses a different task: A preprocessing container needs a database credential and currently keeps a plaintext password in its Dockerfile. The selected workloads instead require Reject unencrypted data uploads, Trace unauthorized endpoint calls, Least privilege build stage.

That alternative addresses a different task: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. The selected workloads instead require Reject unencrypted data uploads, Trace unauthorized endpoint calls, Least privilege build stage.

That alternative addresses a different task: Security operations detects unexpected calls to model-management APIs and needs immutable audit evidence identifying the AWS principal and originating source. The selected workloads instead require KMS model artifact protection, Cross account training dataset access, Restrict inference ingress.

That alternative addresses a different task: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. The selected workloads instead require KMS model artifact protection, Cross account training dataset access, Restrict inference ingress.

That alternative addresses a different task: An ML deployment pipeline pulls a custom container image containing a known vulnerable package and security wants the image rejected before production. The selected workloads instead require KMS model artifact protection, Cross account training dataset access, Restrict inference ingress.

That alternative addresses a different task: A regulated organization stores model artifacts in S3 and requires auditable control over which deployment roles can decrypt them. The selected workloads instead require Private network processing jobs, Encrypted captured inference records, Continuous configuration compliance.

That alternative addresses a different task: Security operations detects unexpected calls to model-management APIs and needs immutable audit evidence identifying the AWS principal and originating source. The selected workloads instead require Private network processing jobs, Encrypted captured inference records, Continuous configuration compliance.

That alternative addresses a different task: An ML deployment pipeline pulls a custom container image containing a known vulnerable package and security wants the image rejected before production. The selected workloads instead require Private network processing jobs, Encrypted captured inference records, Continuous configuration compliance.

That alternative addresses a different task: A regulated organization stores model artifacts in S3 and requires auditable control over which deployment roles can decrypt them. The selected workloads instead require ECR vulnerability findings, Least privilege build stage, Scoped SageMaker execution permissions.

That alternative addresses a different task: A hospital's training jobs should not call arbitrary public internet endpoints while reading private patient data. The selected workloads instead require ECR vulnerability findings, Least privilege build stage, Scoped SageMaker execution permissions.

That alternative addresses a different task: Security operations detects unexpected calls to model-management APIs and needs immutable audit evidence identifying the AWS principal and originating source. The selected workloads instead require ECR vulnerability findings, Least privilege build stage, Scoped SageMaker execution permissions.

That diagnostic measures a different AWS ML behavior: A SageMaker training job was given administrator-level permissions, though it only needs one S3 training prefix and a KMS key. It cannot establish the main condition: A preprocessing container needs a database credential and currently keeps a plaintext password in its Dockerfile. The decisive evidence for this case is: Inspect IAM access to Secrets Manager and rotation metadata without exposing the secret value in logs.

That diagnostic measures a different AWS ML behavior: Security operations detects unexpected calls to model-management APIs and needs immutable audit evidence identifying the AWS principal and originating source. It cannot establish the main condition: A preprocessing container needs a database credential and currently keeps a plaintext password in its Dockerfile. The decisive evidence for this case is: Inspect IAM access to Secrets Manager and rotation metadata without exposing the secret value in logs.

That diagnostic measures a different AWS ML behavior: A regulated organization stores model artifacts in S3 and requires auditable control over which deployment roles can decrypt them. It cannot establish the main condition: A preprocessing container needs a database credential and currently keeps a plaintext password in its Dockerfile. The decisive evidence for this case is: Inspect IAM access to Secrets Manager and rotation metadata without exposing the secret value in logs.