MLA-C01 Practice Question 58: Private Endpoint Invocation
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 6 · question 8 of 10
A bank runs a loan-decision service on Amazon EC2 instances in private subnets. The subnets have no internet gateway or NAT gateway, and security policy forbids adding either. The service must call InvokeEndpoint on a SageMaker AI real-time endpoint in the same account and Region. Calls currently time out because the instances cannot reach the SageMaker AI Runtime API.
What should the engineer configure?
Show answer and explanation
Answer:
The SageMaker AI Runtime API supports interface VPC endpoints powered by AWS PrivateLink. An interface endpoint places network interfaces for the runtime service in the private subnets, and with private DNS enabled the SDK's usual runtime hostname resolves to those private IP addresses. InvokeEndpoint calls then travel entirely within the AWS network, with no internet gateway or NAT gateway and no change to the application code (option D).
- A is wrong because gateway VPC endpoints exist only for Amazon S3 and Amazon DynamoDB. SageMaker AI is reached through interface endpoints. - B is wrong because a model's VpcConfig controls network access *from* the model container, for example to data sources in the VPC. Callers still reach the endpoint through the public SageMaker AI Runtime API, which these instances cannot reach. - C is wrong because a NAT gateway is exactly what the security policy forbids, however tightly its traffic is filtered.
Reference: Connect to SageMaker AI Within your VPC