MLA-C01 Practice Question 30: CloudTrail Endpoint Deletion Audit
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 3 · question 10 of 10
A production SageMaker AI endpoint vanished overnight and inference calls began failing. The security team needs to know which IAM principal called DeleteEndpoint, from what IP address, and at what time. The endpoint was deleted six days ago. Nobody configured any auditing for SageMaker AI in this account before the incident.
Where should the team look first?
Show answer and explanation
Answer:
CloudTrail records every SageMaker AI control plane call, including DeleteEndpoint, as a management event, and each entry carries the userIdentity that made the call, the sourceIPAddress, and the eventTime. Critically, CloudTrail is active from the moment the account is created and Event history keeps the last 90 days of management events with no prior setup and no charge, so a six-day-old deletion is still there even though nobody configured anything in advance (option B).
- A is wrong because that log group holds output written by the endpoint's own containers. An API call that destroys the endpoint is not something the container logs. - C is wrong because AWS Config only records resources after a configuration recorder is enabled, which nobody did here, and Config tracks configuration state over time, not the identity that issued an API call. - D is wrong because a metric going to zero tells the team roughly when traffic stopped. It identifies no principal, no IP address, and no API call.
Reference: Logging Amazon SageMaker AI API calls using AWS CloudTrail