MLA-C01 Practice Question 50: Inter Container Traffic Encryption
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 5 · question 10 of 10
A payment processor trains a fraud model on cardholder transaction data using a SageMaker AI training job that spans eight GPU instances in private VPC subnets. The training data in Amazon S3 is already encrypted with an AWS KMS key, and the job's storage volumes use the same key. An auditor flags one remaining gap: data exchanged *between* the training instances during distributed training is not encrypted. The team accepts that fixing this may make training slower.
What should the team do?
Show answer and explanation
Answer:
Inter-container traffic encryption protects data sent between the ML compute instances of a distributed training job. AWS calls it best practice for sensitive data such as healthcare records, and the same applies to regulated cardholder data. It is a single setting on the training job, and AWS notes that it can increase training time, especially for distributed deep learning, which is the trade-off the team has already accepted. It has no effect on a single-instance job, which is why it matters here with eight instances (option D).
- A is wrong because network isolation blocks the containers' outbound network calls. It protects against exfiltration, but traffic between the job's own instances still flows unencrypted. - B is wrong because a gateway endpoint changes the route to Amazon S3. It does not touch instance-to-instance traffic inside the cluster, and it provides routing, not encryption. - C is wrong because KMS keys on volumes and output encrypt data *at rest*. The auditor's gap is data *in transit* between instances, and the scenario says the volumes already use the key.
Reference: Protect Communications Between ML Compute Instances in a Distributed Training Job