MLA-C01 Practice Question 90: Config Rule Endpoint Encryption
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 9 · question 10 of 10
A healthcare company's auditors require continuous evidence that every SageMaker AI endpoint configuration in its accounts specifies an AWS KMS key for encrypting endpoint storage. They want each endpoint configuration, existing and future, evaluated automatically and marked compliant or noncompliant, with a history of those results they can review at audit time.
What should the ML engineer set up?
Show answer and explanation
Answer:
AWS Config continuously evaluates resource configurations against rules and keeps the history of compliance results. The managed rule sagemaker-endpoint-configuration-kms-key-configured checks AWS::SageMaker::EndpointConfig resources and marks one NON_COMPLIANT if KmsKeyId is not specified. It evaluates existing and new endpoint configurations with no custom code and produces the per-resource compliance record the auditors asked for (option C).
- A is wrong because a quarterly query over API logs is a manual, periodic check, not a continuous evaluation. It also sees only configurations created while the trail was logging, not every existing resource. - B is wrong because a deny policy is a *preventive* control. It can stop new noncompliant configurations, but it does not evaluate existing ones or keep a compliance history. It works well alongside the Config rule but does not replace it. - D is wrong because Trusted Advisor runs a fixed set of AWS best-practice checks. It is not a way to evaluate each endpoint configuration against your own requirement, and weekly summary emails are not a per-resource compliance history.
Reference: sagemaker-endpoint-configuration-kms-key-configured - AWS Config