Exam AWS Certified Machine Learning - Specialty topic 1 question 126 discussion

Exam question from Amazon's AWS Certified Machine Learning - Specialty

Question #: 126
Topic #: 1

[All AWS Certified Machine Learning - Specialty Questions]

A machine learning specialist is developing a proof of concept for government users whose primary concern is security. The specialist is using Amazon
SageMaker to train a convolutional neural network (CNN) model for a photo classifier application. The specialist wants to protect the data so that it cannot be accessed and transferred to a remote host by malicious code accidentally installed on the training container.
Which action will provide the MOST secure protection?

A. Remove Amazon S3 access permissions from the SageMaker execution role.
B. Encrypt the weights of the CNN model.
C. Encrypt the training and validation dataset.
D. Enable network isolation for training jobs.

Show Suggested Answer

Suggested Answer: D 🗳️

by omar_bahrain at March 11, 2021, 4:25 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

AShahine21

Highly Voted 3 years, 2 months ago

I will go with D, "cannot be accessed and transferred to a remote host by malicious code accidentally installed on the training container" Based on the following link: https://aws.amazon.com/blogs/security/secure-deployment-of-amazon-sagemaker-resources/ "EnableNetworkIsolation – Set this to true when creating training, hyperparameter tuning, and inference jobs to prevent situations like malicious code being accidentally installed and transferring data to a remote host."

upvoted 18 times

...

achiko

Highly Voted 3 years, 3 months ago

If you enable network isolation, the containers can't make any outbound network calls, even to other AWS services such as Amazon S3. Additionally, no AWS credentials are made available to the container runtime environment. In the case of a training job with multiple instances, network inbound and outbound traffic is limited to the peers of each training container. SageMaker still performs download and upload operations against Amazon S3 using your SageMaker execution role in isolation from the training or inference container.

upvoted 8 times

3 years, 1 month ago

I choose D. More document about it: https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html

upvoted 2 times

...

benson2021

3 years, 2 months ago

Answer is D. https://aws.amazon.com/blogs/security/secure-deployment-of-amazon-sagemaker-resources/ search for 'isolation' and there is a security parameter : EnableNetworkIsolation talking about this.

upvoted 4 times

...

Vita_Rasta84444

3 years, 2 months ago

I would choose C

upvoted 1 times

...

omar_bahrain

3 years, 3 months ago

most likely it is C. https://docs.aws.amazon.com/sagemaker/latest/dg/data-protection.html

upvoted 5 times

Dr_Kiko

3 years, 1 month ago

incorrect; you CAN transfer encrypted files even w/o a key D is a better option

upvoted 1 times

...