Amazon Web Services Updated MLA-C01 Exam Questions and Answers by edmund

Amazon SageMaker automatically tracks the Invocations metric, which represents the number of API calls made to the endpoint, in Amazon CloudWatch. By adding this metric to a CloudWatch dashboard, you can monitor the endpoint ' s activity in real-time. Setting up a CloudWatch alarm allows the system to send notifications whenever the API call events exceed the defined threshold, meeting both the monitoring and notification requirements efficiently.

In AWS networking, security groups are stateful and allow-only, meaning they cannot explicitly deny traffic. As a result, Option A is invalid. Network ACLs (NACLs), on the other hand, are stateless and support both allow and deny rules, making them the correct mechanism for blocking traffic from specific IP addresses.

Because the SageMaker AI domain is deployed in a public subnet, inbound traffic reaches the subnet before it reaches the resource. AWS documentation states that NACLs are evaluated at the subnet level and are ideal for implementing IP-based blocking rules.

Route tables control routing paths, not traffic filtering, so Option D is incorrect. Option C is unrelated to network security and does not block traffic.

AWS best practices clearly recommend using network ACL deny rules when an explicit block is required for a specific IP address at the subnet boundary.

Therefore, Option B is the correct and AWS-aligned solution.

Option C is correct because the company needs Kubernetes hosting, does not want to manage the control plane, wants repeatable infrastructure provisioning, and requires that provisioning be done by using Python. Amazon EKS is AWS’s managed Kubernetes service, so it satisfies the requirement to avoid managing the Kubernetes control plane directly. The AWS CDK documentation also confirms that Python is a fully supported client language for defining infrastructure as code.

AWS CDK is the best fit because it lets engineers define cloud infrastructure programmatically in Python and deploy it in a repeatable way. The AWS CDK EKS construct library specifically supports defining Amazon EKS clusters and related Kubernetes resources. This makes it a strong match for infrastructure that must be reproducible and expressed in code rather than provisioned manually. Since the model is already packaged in a container, storing the image in Amazon ECR and then deploying it to Amazon EKS follows the normal AWS container workflow.

The other options are less suitable. Option A requires setting up and managing a Kubernetes cluster on EC2, which violates the requirement to avoid control-plane management. Option B uses the AWS CLI, but the question specifically requires infrastructure provisioning by using Python, not command-line provisioning. Option D uses CloudFormation, which is repeatable infrastructure as code, but the question explicitly says the infrastructure must be provisioned by using Python. AWS CDK uniquely satisfies both the IaC and Python requirements while using managed Kubernetes with EKS.

Therefore, the best verified AWS-docs answer is C.

AWS Secrets Manager is designed for securely storing, managing, and automatically rotating secrets, including API tokens. By configuring a Lambda function for custom rotation logic, the solution can automatically rotate the API tokens every 3 months as required. Secrets Manager simplifies secret management and integrates seamlessly with other AWS services, making it the ideal choice for this use case.