MLA-C01 Practice Question 96: IP Insights Login Anomalies
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 10 · question 6 of 10
An online bank wants to add a risk score to each customer login so that unusual logins trigger step-up authentication. The main signal is whether a customer is logging in from an IP address that does not fit that customer's history. The bank has two years of login records, each an (account_id, IPv4 address) pair, but no labels marking which logins were fraudulent. The team wants a SageMaker AI built-in algorithm.
Which algorithm fits this problem?
Show answer and explanation
Answer:
IP Insights is an unsupervised algorithm that learns associations between IPv4 addresses and entities such as user IDs or account numbers. It trains on historical (entity, IPv4 address) pairs and learns each entity's IP usage patterns. At inference it scores how anomalous a new pair is, for example a user logging in from an unusual IP address, which AWS gives as a typical use. The bank's login history is exactly that input, and no fraud labels are needed (option D).
- A is wrong because turning IP addresses into integers treats nearby numbers as similar and ignores *which account* is logging in. An address that is normal for one customer can be suspicious for another. - B is wrong because a supervised classifier needs fraud labels, which the bank does not have. - C is wrong because clustering octets groups addresses by numeric closeness across all users. Like option A, it does not model the relationship between a specific account and its addresses.
Reference: IP Insights