Free AWS Certified Machine Learning Engineer - Associate (MLA-C01) Sample Questions

Correct answer: B — 1, 2, 3, 4

• A. Incorrect. This sequence attempts to create the labeling job (step 3) before preparing and uploading the input dataset to S3 (step 1). The location of the input data is a mandatory parameter required at the time of job creation, so this order would result in an error.
• B. Correct. This sequence represents the logical and required workflow for creating a SageMaker Ground Truth labeling job. First, the data to be labeled must be prepared and stored in an S3 bucket (1). Concurrently or next, a workforce must be selected or created (2). With both the data and workforce available, the labeling job can be created, configuring all parameters such as the S3 input/output paths, the workforce ARN, and the labeling task instructions (3). Finally, after the job is launched, its progress is monitored, and the labeled data is retrieved from the specified output S3 location upon completion (4).
• C. Incorrect. This sequence incorrectly places the creation of the labeling job (step 3) as the very first step. A Ground Truth job cannot be created without specifying the input dataset location (step 1) and the workforce that will perform the task (step 2).
• D. Incorrect. This sequence is illogical as it starts with monitoring the job (step 4) before it has been created. Monitoring is a post-creation activity.

Correct answer: B — It is the primary resource that contains metadata and data for a set of features.

• A. Incorrect. While a Feature Group does logically group features that can be used to train a model, its purpose is much broader than being tied to a single, specific model. Feature Groups are designed to be reusable across multiple models, applications, and teams.
• B. Correct. A Feature Group is the fundamental and primary resource in Amazon SageMaker Feature Store. It serves as a container that holds the schema (metadata, such as feature names and data types) and the actual data records for a set of features. It also manages the ingestion and storage of features into both an online store for low-latency retrieval and an offline store for training and batch inference.
• C. Incorrect. This describes a capability enabled by the Feature Store, not the Feature Group itself. A point-in-time correct snapshot for model training is created by querying the offline store of one or more Feature Groups. The Feature Group is the persistent container for the feature data over time, not a static, time-bound snapshot.
• D. Incorrect. This confuses a data resource with a security resource. A Feature Group is a resource for storing and managing feature data. Access to a Feature Group is controlled by AWS Identity and Access Management (IAM) roles and policies, but the Feature Group itself is not an IAM role.

Correct answer: A — 1, 2, 4, 3

• A. Correct. This sequence (Split -> Clean -> Transform -> Select) represents the best practice for preventing data leakage. By splitting the data first (1), the test set is completely isolated from the training process. All subsequent steps—cleaning (2), transformation (4), and feature selection (3)—are then performed correctly. Any parameters required for these steps (e.g., mean for imputation, scaling factors, feature importance scores) are learned only from the training set and then applied to both the training and test sets. This ensures an unbiased evaluation of the model's performance.
• B. Incorrect. This sequence (Clean -> Transform -> Select -> Split) is a common anti-pattern that leads to data leakage. If data transformation (e.g., standardization using the mean and standard deviation of the entire dataset) or feature selection are performed on the full dataset before splitting, information from the test set leaks into the training process. This leads to an overly optimistic performance evaluation and a model that generalizes poorly to new, unseen data.
• C. Incorrect. This sequence is illogical because it suggests performing data transformation (4) and feature selection (3) before data cleaning (2). For reliable results, raw data must be cleaned of errors, inconsistencies, and missing values before feature engineering or selection is attempted.
• D. Incorrect. This sequence starts with feature selection (3), which is generally performed on cleaned and prepared data. Performing selection before the split (1) can also lead to data leakage if the selection process involves the target variable or dataset-wide statistics.

Correct answer: B — Difference in Proportions of Labels (DPL)

• A. Incorrect. Class Imbalance (CI) measures the unequal distribution of classes across the entire dataset (e.g., the proportion of positive vs. negative labels overall). It does not specifically quantify the difference in label distribution between two distinct subgroups.
• B. Correct. Difference in Proportions of Labels (DPL) is the pre-training bias metric that precisely matches the definition in the question. It is calculated as the simple difference between the proportion of positive labels in one group and the proportion of positive labels in another, directly quantifying the disparity in label distribution between them.
• C. Incorrect. Kullback-Leibler (KL) divergence is a more general and complex statistical measure of how one probability distribution diverges from a reference distribution. It is asymmetric and captures relative differences, but it is not calculated as the simple difference in proportions described in the question.
• D. Incorrect. Jensen-Shannon (JS) divergence is a symmetric and bounded measure of the similarity between two probability distributions. While it can be used to compare label distributions, it does not match the specific calculation (a simple difference of proportions) described in the question.

Correct answers: A, C — Removing duplicate rows.; Validating that a column contains only values from a specific set (e.g., 'USA', 'CAN', 'MEX').

• A. Correct. AWS Glue DataBrew is a data preparation tool, and a common data cleaning task is deduplication. DataBrew recipes include transformations to identify and remove duplicate rows based on all columns or a specific subset of columns. This is a core feature for ensuring data quality.
• B. Incorrect. AWS Glue DataBrew is designed for visual data preparation, cleaning, and normalization. It does not have the capability to train machine learning models. Model training is performed using services like Amazon SageMaker.
• C. Correct. DataBrew supports various data validation and cleaning tasks. A recipe can include steps to filter rows or create new columns based on conditions, which can enforce that a column's values belong to a predefined set. This is a key part of ensuring data integrity and quality before modeling.
• D. Incorrect. Deploying data or models to a real-time endpoint is a model serving function, not a data preparation task. This is typically handled by services like Amazon SageMaker Hosting, not AWS Glue DataBrew.
• E. Incorrect. Creating a model bias report is part of the model evaluation and monitoring phase. While DataBrew prepares the data for this analysis, the report itself is generated by tools like Amazon SageMaker Clarify, not within a DataBrew recipe.

Correct answer: C — Attach a larger EBS volume (e.g., 16 TB) to the SageMaker training instance.

• A. This is incorrect. Increasing the number of vCPUs enhances computational power and can speed up training, but it does not address the fundamental issue of insufficient storage space. The training job will still fail when it attempts to load the 10 TB dataset onto the 1 TB EBS volume.
• B. This is incorrect. SageMaker Pipe Mode is designed to stream data directly to a training algorithm, which would solve the disk space issue. However, the question explicitly states that the training algorithm does not support streaming data, making this option incompatible with the given constraints.
• C. This is the correct and most effective strategy. Since the algorithm cannot stream data, the entire 10 TB dataset must be available on the training instance's local storage. By attaching a larger Amazon EBS volume (e.g., 16 TB, which is greater than the 10 TB dataset size), the instance will have sufficient disk space to download and process the entire dataset, directly solving the storage bottleneck.
• D. This is not the most effective strategy. While mounting an Amazon EFS file system would provide access to the 10 TB dataset without using the local EBS volume, EFS is a distributed file system designed for shared access and may introduce higher latency and lower throughput compared to a dedicated, locally attached EBS volume. For I/O-intensive ML training workloads, EBS is the more performant and recommended storage option.

Correct answer: A — 3, 1, 2, 4

• A. This sequence represents the correct logical order for building an AWS Glue ETL pipeline. First, you must run a crawler on the source data (3) to infer its schema and create a table in the AWS Glue Data Catalog. Second, with the source table defined, you can author the ETL job (1), referencing this table as its source. Third, you execute the authored job (2) to perform the transformation. Finally, to make the new Parquet data queryable by Amazon Athena, you run a second crawler on the target location (4) to catalog the transformed files.
• B. This order is incorrect because it attempts to author the ETL job (1) before crawling the source data (3). The job is described as reading from the AWS Glue Data Catalog, so the source table and schema must exist in the catalog before the job can be successfully authored to use it.
• C. This order is incorrect because it attempts to run the ETL job (2) before it has been authored (1). A job must be created and defined before it can be executed.
• D. This order is incorrect because it begins by running the ETL job (2). This is not possible because the job has not yet been authored (1), and the source data has not been cataloged (3), which is a prerequisite for the job's source input.

Correct answer: C — Amazon FSx for Lustre.

• A. Incorrect. Amazon EFS in General Purpose mode is a managed NFS file system but is not optimized for the extreme throughput and consistent sub-millisecond latencies required by HPC and large-scale ML training workloads. While EFS has a Max I/O mode, Amazon FSx for Lustre is the purpose-built solution for this specific use case.
• B. Incorrect. Amazon S3 is an object storage service, not a high-performance, POSIX-compliant file system. It does not provide the sub-millisecond latencies needed for tightly-coupled HPC workloads. An S3 VPC Gateway Endpoint provides secure network access but does not change the fundamental nature or latency characteristics of S3.
• C. Correct. Amazon FSx for Lustre is a fully managed, high-performance file system specifically designed for compute-intensive workloads like HPC and ML training. It is based on the Lustre file system, provides sub-millisecond latencies, massive throughput, and is the ideal service for migrating existing on-premises Lustre workloads to AWS.
• D. Incorrect. While a RAID 0 array of EBS volumes can provide high performance, it is block storage attached to a single EC2 instance. It is not a shared, distributed network file system that can be accessed by multiple nodes in a training cluster. Furthermore, it is not a 'fully managed' file system service, as the user is responsible for managing the RAID configuration and has no data redundancy with RAID 0.

Correct answers: B, C — Distribute the files across multiple S3 prefixes.; Package the small files into larger, consolidated files like TFRecord or RecordIO.

• A. Incorrect. Enabling versioning on an S3 bucket is a data protection feature used to preserve, retrieve, and restore every version of every object stored. It does not improve data throughput or mitigate request throttling; it can actually increase storage costs and complexity.
• B. Correct. Amazon S3 performance scales per prefix. By default, a single prefix can support a high rate of requests. However, distributing the files across multiple prefixes allows S3 to partition the key namespace, which significantly increases the achievable request rate in parallel. This directly addresses the throttling issue by spreading the request load.
• C. Correct. Reading a large number of small files results in a high number of S3 GET requests, each with its own latency and overhead, which can lead to throttling. Packaging these small files into larger, consolidated files (e.g., TFRecord, Parquet, or RecordIO) drastically reduces the total number of S3 requests required, leading to much higher overall throughput and more efficient reads.
• D. Incorrect. S3 Standard-Infrequent Access (S3 Standard-IA) is a storage class designed for cost-effective storage of data that is accessed less frequently but requires rapid access when needed. It does not offer better read performance than S3 Standard and may incur additional data retrieval fees, making it unsuitable for improving performance in this scenario.
• E. Incorrect. The problem described is an I/O bottleneck due to S3 request limits, not a compute bottleneck. Increasing the number of vCPUs on the training instances would only help if the job were compute-bound. In this case, it would not solve the throttling issue and could even exacerbate it by allowing more workers to make requests to S3 simultaneously.

Correct answer: C — XGBoost

• A. Incorrect. K-Means is an unsupervised clustering algorithm used to group unlabeled data into clusters based on similarity. It is not suitable for a supervised multi-class classification task, which requires predicting predefined categories from a labeled dataset.
• B. Incorrect. Principal Component Analysis (PCA) is an unsupervised dimensionality reduction technique, not a classification algorithm. It is used to reduce the number of features in a dataset but cannot perform classification. It can, however, be used as a preprocessing step before applying a classifier.
• C. Correct. XGBoost is a powerful and highly performant gradient boosting algorithm, well-suited for supervised learning tasks like multi-class classification. The Amazon SageMaker built-in XGBoost algorithm is optimized to handle large datasets efficiently. It can be applied directly to tabular data or to text data after it has been converted into numerical features (e.g., using TF-IDF or word embeddings), making it an excellent choice for this use case.
• D. Incorrect. Random Cut Forest is an unsupervised algorithm specifically designed for anomaly detection. Its purpose is to identify outliers in a dataset, not to classify data points into predefined categories, making it unsuitable for this task.

Correct answers: A, C, E — Add more relevant features to the dataset.; Use a more complex model (e.g., switch from linear regression to a gradient boosting model).; Perform polynomial feature engineering to capture non-linear relationships.

• A. This is a correct approach. Underfitting often occurs when the model doesn't have enough information to capture the underlying trends in the data. Adding more relevant features provides the model with additional signals that can help explain the variance in the target variable, thereby reducing bias and improving its predictive power.
• B. This is incorrect. L2 regularization is a technique used to combat overfitting by penalizing large model coefficients, which effectively simplifies the model. Increasing the strength of regularization would add more bias to an already underfitting model, making its performance even worse. To address underfitting, one should consider decreasing or removing regularization.
• C. This is a correct approach. If a model is underfitting, it's often because its capacity is too low to learn the complex patterns in the data. Switching to a more complex model, such as moving from a simple linear regression to a gradient boosting model or a deep neural network, increases the model's capacity to fit the data better and capture non-linear relationships.
• D. This is incorrect. Decreasing the number of training epochs means the model has less opportunity to learn from the data and adjust its weights. This is likely to halt the training process before the model has converged, thus causing or worsening underfitting. To address underfitting, one might need to increase the number of epochs, not decrease them.
• E. This is a correct approach. Polynomial feature engineering creates new features by raising existing features to a power or creating interaction terms. This is a powerful technique to increase model complexity without changing the underlying algorithm. It allows simpler models, like linear regression, to capture non-linear relationships, which is a common way to address underfitting.

Correct answer: A — Amazon Transcribe with speaker diarization enabled

• A. Correct. Amazon Transcribe is an automatic speech recognition (ASR) service that converts speech to text. Its speaker diarization feature is specifically designed to identify and label different speakers in an audio recording, which directly fulfills the requirement to distinguish between the customer and the agent in the conversation.
• B. Incorrect. Amazon Polly is a text-to-speech service. Its function is the opposite of what is required; it converts text into lifelike speech, rather than converting audio recordings into text.
• C. Incorrect. Amazon Lex is a service used for building conversational interfaces like chatbots. While it processes speech for real-time interactions with a bot, it is not the primary tool for batch transcribing pre-existing audio recordings and identifying multiple speakers.
• D. Incorrect. Amazon Comprehend is a natural language processing (NLP) service that operates on text data to extract insights like sentiment, entities, and key phrases. It cannot process audio files. Comprehend would be a logical next step to analyze the text output generated by Amazon Transcribe, but it cannot perform the initial transcription.

Correct answer: C — The probability that a neuron's output is set to zero during training.

• A. Incorrect. The dropout rate is a regularization technique that applies to the neurons within a network layer, not the training data itself. Dropping training examples would be a form of data sampling, which is a different concept.
• B. Incorrect. The dropout rate is unrelated to the learning rate or its decay schedule. Learning rate decay is a separate hyperparameter used to adjust the step size of the optimizer over time, whereas dropout is a regularization technique that affects the network's architecture during training.
• C. Correct. The dropout rate defines the probability that any given neuron's output will be set to zero during a forward pass in the training phase. This temporary 'dropping' of neurons forces the network to learn more robust features and prevents complex co-adaptations between neurons, which helps to reduce overfitting. During inference, dropout is typically turned off, and the outputs of the remaining neurons are scaled to account for the dropped units during training.
• D. Incorrect. This describes weight pruning, a different technique used for model compression and optimization. Pruning involves permanently removing weights after training is complete, whereas dropout temporarily sets neuron outputs to zero only during the training phase.

Correct answer: A — Regression

• A. This is a regression problem because the objective is to predict a continuous numerical value: the number of days remaining until failure. This value is often referred to as the Remaining Useful Life (RUL). Regression models are specifically designed to predict quantitative outputs.
• B. Clustering is an unsupervised learning technique used to group similar data points together based on their features. It does not predict a specific target value. While it could be used to discover patterns in sensor data, it cannot directly predict the number of days until a part fails.
• C. Multi-class classification is a supervised learning task used to predict a discrete class label from a finite set of categories. This would be appropriate if the problem was framed to predict discrete time buckets (e.g., 'fails in 0-7 days', 'fails in 8-14 days', etc.), but the current goal is to predict a specific, continuous number of days.
• D. Anomaly detection is used to identify rare items, events, or observations which raise suspicions by differing significantly from the majority of the data. While it can be a component of a predictive maintenance system to flag sudden faults, it does not predict the remaining time until a failure is expected to occur.

Correct answer: D — A shadow variant

• A. Incorrect. A/B testing involves routing a portion of live traffic to the new model variant and the rest to the existing one. Users in each group receive responses from their respective models, which directly impacts the user experience for the group receiving the new model's output. This is used to compare business metrics, not just for silent evaluation.
• B. Incorrect. A blue/green deployment is a strategy to reduce risk and downtime during a model update. It involves shifting all traffic from the old model (blue) to a fully tested new model (green). It does not support running two models in parallel on live traffic for comparison without affecting all users after the switch.
• C. Incorrect. A multi-model endpoint is a cost-optimization feature that allows hosting multiple models on a single endpoint. The calling application must specify which model to invoke for each request. It is not a deployment strategy designed for comparing model versions on the same traffic stream.
• D. Correct. A shadow variant, also known as shadow testing, is the ideal strategy for this use case. SageMaker duplicates the inference requests sent to the production model and sends a copy to the shadow variant. However, only the response from the production model is returned to the user, ensuring the user experience is completely unaffected. The predictions from the shadow variant are logged for offline analysis, allowing the team to evaluate its performance on live traffic. While this strategy does incur compute costs for both variants, it is the only option that meets the primary requirement of silent evaluation on live traffic without user impact.

Correct answers: A, D — Using AWS CodeCommit for version control and Amazon SageMaker Experiments to track runs.; Using Amazon SageMaker Pipelines to orchestrate and track the entire workflow.

• A. This is a correct combination. AWS CodeCommit is a managed source control service based on Git, ideal for versioning the training source code. Amazon SageMaker Experiments is specifically designed to organize, track, compare, and evaluate ML training runs. It captures essential metadata for reproducibility, including hyperparameters, dataset locations, and model artifacts.
• B. This is incorrect. While Amazon S3 is the standard service for storing model artifacts, it does not provide the necessary metadata tracking for reproducibility on its own. AWS CloudTrail is an audit service for API calls and is not designed for structured ML experiment tracking. Sifting through CloudTrail logs to reproduce an experiment would be impractical.
• C. This is incorrect. AWS Lambda can be used for triggering processes, and Amazon CloudWatch is used for logging and monitoring. However, this combination lacks a dedicated mechanism to track and version the inputs (code, data, hyperparameters) and outputs of a training run in a structured manner required for easy reproducibility.
• D. This is a correct combination. Amazon SageMaker Pipelines provides an end-to-end solution for building and managing ML workflows. It automatically tracks the lineage of each step, including the code scripts, data inputs, parameters, and artifacts. This creates a fully reproducible workflow by design, as each pipeline execution can be reviewed and re-run with the exact same configuration.
• E. This is incorrect. AWS Glue and Amazon Athena are powerful services for data preparation (ETL) and data analysis (interactive querying), respectively. While they play a role in the overall ML lifecycle, they do not address the core requirement of tracking and versioning the model training process for reproducibility.

Correct answer: B — 1. Write a Python script for the custom rule logic. 2. Create a DebuggerHookConfig to save the validation accuracy tensor. 3. Instantiate the custom rule using PythonRule, referencing the script. 4. Configure the SageMaker Estimator with the hook config and the custom rule.

• A. This option presents the steps in an incorrect and illogical order. It's not possible to instantiate a custom rule (Step 1) or configure the estimator with it (Step 2) before the underlying Python script containing the rule's logic has been written (Step 3).
• B. This is the correct sequence. First, the logic for the custom rule must be defined in a Python script. Second, a DebuggerHookConfig must be created to tell SageMaker which specific tensors (in this case, validation_accuracy) to save and make available to the rule. Third, the custom rule is instantiated (e.g., using `PythonRule` or `Rule.custom`) by referencing the script. Finally, the SageMaker Estimator is configured with both the hook configuration and the rule instance before starting the training job.
• C. This option incorrectly proposes using SageMaker Model Monitor. Model Monitor is designed for monitoring deployed models in production for issues like data drift or concept drift, not for debugging live training jobs. The correct tool for this use case is SageMaker Debugger.
• D. This option is incomplete and will not work. It omits the critical step of creating and providing a `DebuggerHookConfig` to the estimator. Without the hook configuration, SageMaker Debugger will not know which tensors to save from the training job. Consequently, the custom rule will not receive the `validation_accuracy` tensor it needs to evaluate the stopping condition.

Correct answer: C — To compile source code, run tests, and produce software packages that are ready to deploy.

• A. Incorrect. AWS CodeBuild is a build service, not an orchestration service. The end-to-end orchestration of a CI/CD pipeline, coordinating various stages from source control to deployment, is the primary function of services like AWS CodePipeline or AWS Step Functions.
• B. Incorrect. While CodeBuild produces artifacts (like a container image or compiled model), its primary function is not to store or version them. Long-term storage and versioning of ML artifacts are handled by services like Amazon S3, Amazon ECR for container images, or a dedicated model registry like Amazon SageMaker Model Registry.
• C. Correct. AWS CodeBuild is a fully managed continuous integration (CI) service. Its core function is to take source code, run build commands defined in a buildspec file, execute tests (such as unit tests, data validation, or model quality checks), and produce deployable artifacts. In an MLOps context, this often involves packaging a model and inference code into a Docker container.
• D. Incorrect. This describes the primary function of AWS CodeDeploy. While CodeBuild is a critical step in the CI/CD process that prepares the application for deployment, the actual act of automating the deployment to compute services like Amazon EC2, AWS Lambda, or Amazon ECS is handled by a deployment service like AWS CodeDeploy.

Correct answer: C — The endpoint will be serving 100% of the traffic from the original, pre-deployment model version.

• A. This is incorrect. A rollback's purpose is to maintain service availability by reverting to a known stable state. Deleting the endpoint would cause a service outage, which is the opposite of the intended outcome of an automated rollback.
• B. This is incorrect. A split traffic configuration might exist temporarily during the traffic-shifting phase of the deployment. However, after a rollback is triggered and completed, traffic is fully reverted to the original version, not split between the old and new models.
• C. This is correct. The fundamental principle of a blue/green deployment rollback is to restore the system to its last known good state. When the CloudWatch alarm is triggered, CodeDeploy automatically shifts 100% of the production traffic back to the original, pre-deployment model version (the 'blue' environment) to ensure service stability and availability.
• D. This is incorrect. The entire purpose of a blue/green deployment with automated rollbacks is to avoid downtime. The endpoint continues to serve requests using the stable, original model version, ensuring continuous service availability while the problematic new version is taken out of the request path.

Correct answer: C — AWS CodeBuild

• A. Incorrect. AWS CodeDeploy is a service that automates application deployments to various compute services like Amazon EC2, AWS Fargate, AWS Lambda, and on-premises servers. It is used in the deployment phase of a CI/CD pipeline, not the build phase, and it does not build container images.
• B. Incorrect. AWS CodePipeline is a continuous delivery service that automates the release pipelines for fast and reliable application and infrastructure updates. It orchestrates the entire CI/CD workflow, invoking other services for specific actions like building, testing, and deploying. It does not perform the build itself but would trigger a service like AWS CodeBuild to do so.
• C. Correct. AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. It is specifically designed for the build phase of a CI/CD pipeline. CodeBuild can be configured to run Docker commands, enabling it to build a custom Docker container image from a `Dockerfile` with all required dependencies, such as the specified C++ libraries. The resulting image can then be pushed to a container registry.
• D. Incorrect. Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images. ECR is the destination where the built image is stored and from where it is pulled for deployment. It does not have the capability to build the images itself.

Correct answer: B — Amazon Elastic Kubernetes Service (EKS).

• A. Incorrect. Amazon ECS is a powerful, fully managed container orchestration service from AWS, but it is not based on Kubernetes. It uses its own APIs and orchestration system. Therefore, the company's existing Kubernetes-based tooling would not be compatible, failing to meet a key requirement.
• B. Correct. Amazon EKS is the AWS managed service for running Kubernetes. It allows organizations to use their existing Kubernetes tooling, manifests, and expertise while offloading the operational burden of managing the Kubernetes control plane to AWS. This directly addresses the company's need to reduce overhead while maintaining compatibility with their current tooling.
• C. Incorrect. AWS Elastic Beanstalk is a Platform as a Service (PaaS) designed to simplify the deployment and scaling of web applications and services. It is not a general-purpose container orchestrator and does not provide an interface for or compatibility with standard Kubernetes tooling.
• D. Incorrect. Amazon SageMaker is a fully managed service specifically for building, training, and deploying machine learning models. While it uses containers for inference endpoints, it is not a general-purpose Kubernetes cluster and uses its own SDKs and APIs for management. It would not allow the company to use their existing Kubernetes-based tooling.

Correct answers: A, B, D — An `ENTRYPOINT` or `CMD` instruction to start the serving process.; A web server (e.g., Flask, Gunicorn, NGINX) to handle `/invocations` and `/ping` requests.; A `COPY` instruction to add the model artifacts and inference code into the image.

• A. A Dockerfile for a SageMaker inference container must include either an `ENTRYPOINT` or `CMD` instruction. This instruction is fundamental as it specifies the command that launches the serving application (e.g., a Gunicorn or Flask server) when the container starts. Without it, the container would start and then immediately exit, as it would have no process to run.
• B. SageMaker interacts with real-time inference containers via HTTP requests. Therefore, the container must run a web server that listens on port 8080 and exposes specific endpoints. The two mandatory endpoints are `GET /ping` for health checks and `POST /invocations` to receive data, perform inference, and return predictions. Common choices for this web server include Flask, Gunicorn, FastAPI, or a dedicated model server.
• C. This is incorrect. While Docker has a `HEALTHCHECK` instruction for its own monitoring, SageMaker does not use it. Instead, SageMaker has its own health check mechanism that relies on sending `GET` requests to the `/ping` endpoint that the container's web server is required to implement. A successful `200 OK` response from this endpoint signals to SageMaker that the container is healthy.
• D. A `COPY` (or `ADD`) instruction is essential for building the container image. It is used to bundle the necessary files, such as the inference script (e.g., the Flask application code) and the trained model artifacts, into the container's filesystem. This makes the container self-contained and ensures all required components are available at runtime.
• E. This is incorrect. The AWS Command Line Interface (CLI) is a tool for manual interaction or scripting with AWS services and is not required for the core functionality of a SageMaker inference container. If the container needs to programmatically access other AWS resources (e.g., download a model from S3), it should use the appropriate AWS SDK (like `boto3` for Python), which will automatically use the IAM execution role provided by SageMaker for authentication.

Correct answers: A, D — Target tracking policies require you to define both a metric and a target value for that metric.; Simple scaling policies initiate a scaling action after a single alarm breach and have a cooldown period.

• A. This statement is correct. A target tracking scaling policy requires you to select a metric (such as SageMakerVariantInvocationsPerInstance) and set a target value for it. Amazon SageMaker then automatically creates and manages the necessary CloudWatch alarms that trigger the scaling policy and calculates the scaling adjustments needed to keep the metric at, or close to, the specified target value.
• B. This statement is incorrect. It describes scheduled scaling, not step scaling. Step scaling policies adjust the instance count based on a set of scaling adjustments, or steps, that vary based on the size of the alarm breach. Scheduled scaling is the policy type used to adjust capacity on a predictable, time-based schedule.
• C. This statement is incorrect. Scheduled scaling is designed for predictable traffic patterns that follow a known schedule, such as increasing capacity during business hours and decreasing it overnight. For unpredictable, spiky traffic patterns, reactive policies like target tracking or step scaling, which are based on real-time metrics, are more appropriate.
• D. This statement is correct. Simple scaling is a legacy policy type that triggers a single scaling adjustment (e.g., add one instance) when a CloudWatch alarm is breached. After the scaling action is initiated, the policy enters a cooldown period during which it will not respond to any other alarms. This prevents the system from launching or terminating too many instances in a short period.
• E. This statement is incorrect. Target tracking policies are generally simpler to configure than step scaling policies. With target tracking, you only need to define a metric and a target value. In contrast, step scaling requires you to configure CloudWatch alarms, define multiple metric thresholds, and specify the corresponding step adjustments, making it a more complex setup.

Correct answer: D — Canary deployment

• A. Incorrect. Blue/Green deployment involves two identical production environments. Traffic is switched entirely from the old environment (Blue) to the new one (Green) in a single cutover. It does not involve a gradual, percentage-based shift of traffic.
• B. Incorrect. In a Shadow deployment, the new model version runs in parallel with the old one, receiving a copy of live traffic. However, its responses are not sent to users; they are used for performance validation under real load. This strategy doesn't serve any portion of the production traffic.
• C. Incorrect. A/B testing is primarily an experimentation technique to compare the performance of two or more model versions based on specific business metrics. While it involves splitting traffic, its main goal is to determine which version is superior, rather than to perform a safe, incremental rollout of a new version.
• D. Correct. Canary deployment is a strategy where a new version is gradually rolled out to a small subset of users or traffic. The scenario described—shifting 10% of traffic to the new model, monitoring its performance, and then incrementally increasing the traffic share—is the defining characteristic of a canary release. This approach minimizes risk by limiting the blast radius of any potential issues with the new version.

Correct answer: C — Application Auto Scaling on the endpoint's production variant.

• A. Incorrect. SageMaker Model Monitor is used to detect concept drift, data drift, and model quality issues in production. It provides monitoring and alerts but does not perform infrastructure scaling.
• B. Incorrect. Using a larger instance type (vertical scaling) might handle more traffic per instance but does not provide automatic scaling based on load. This is a static change that can lead to over-provisioning and unnecessary costs during periods of low traffic.
• C. Correct. Application Auto Scaling is the feature designed for this exact purpose. When configured on a SageMaker endpoint's production variant, it automatically adjusts the number of instances (horizontal scaling) based on real-time traffic metrics, such as `SageMakerVariantInvocationsPerInstance`. This ensures high availability and performance during peak loads while minimizing costs during off-peak times.
• D. Incorrect. SageMaker Asynchronous Inference Endpoints are designed for requests with large payloads or long processing times that do not require an immediate response. They use a queueing mechanism and are not suitable for the low-latency, real-time inference scenario described in the question.

Correct answer: D — VPC endpoints (Interface and Gateway) for SageMaker, SageMaker Runtime, and Amazon S3.

• A. Incorrect. An IAM role is essential for identity and access management, enforcing the principle of least privilege for accessing S3 artifacts. However, it controls permissions (what actions are allowed), not the network path of the traffic. It does not prevent API calls from traversing the public internet.
• B. Incorrect. While VPC security groups and network ACLs are crucial network security controls for filtering traffic at the instance and subnet level, they do not by themselves ensure traffic to AWS services remains on the private network. Without VPC endpoints, API calls to services like S3 or SageMaker would still be routed to public endpoints if an Internet Gateway or NAT Gateway is present.
• C. Incorrect. AWS Web Application Firewall (WAF) is used to protect web applications or APIs from common web exploits. It operates at the application layer for public-facing endpoints and is not the appropriate tool for controlling the network path of internal, service-to-service communication between SageMaker and S3 within a VPC.
• D. Correct. This is the most critical configuration for meeting the requirement. VPC endpoints create private connections between a VPC and supported AWS services. By creating interface endpoints for SageMaker and SageMaker Runtime, and a gateway endpoint for S3, all API calls and data transfer (like downloading model artifacts from S3 and sending inference requests) are routed through the AWS private network, completely avoiding the public internet.

Correct answer: C — Amazon CloudWatch

• A. Incorrect. AWS CloudTrail is a service for governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and user activity but is not used for real-time alerting based on SageMaker Model Monitor metrics.
• B. Incorrect. While Amazon SNS is a pub/sub messaging service often used to send notifications, it is a common *target* for an alert, not the service that creates the alert. The alert itself is configured in another service (CloudWatch) which then triggers an SNS notification.
• C. Correct. SageMaker Model Monitor is directly integrated with Amazon CloudWatch. It automatically publishes metrics related to constraint violations to CloudWatch. You can then create CloudWatch Alarms that monitor these metrics and trigger automated actions, such as sending notifications, when a violation exceeds a defined threshold.
• D. Incorrect. AWS Systems Manager is a service for operational management of infrastructure at scale, focusing on tasks like patching, automation, and configuration management. It is not integrated with SageMaker Model Monitor for alerting on model performance.

Correct answer: B — Evaluating model predictions against ground truth labels to calculate metrics like accuracy or RMSE.

• A. This describes A/B testing. This method is used to compare the performance of different model versions using live production traffic to select the best one for full deployment. It is incorrect because the scenario requires tracking the performance of an already deployed model over time, not comparing multiple versions.
• B. This correctly describes Model Quality Monitoring. This process directly addresses the engineer's requirement by systematically evaluating model predictions against actual outcomes (ground truth labels) as they become available. This allows for the calculation of performance metrics like accuracy or RMSE, which is essential for detecting model performance degradation (concept drift) over time.
• C. This describes Data Quality Monitoring, also known as data drift detection. It focuses on monitoring the input data distribution and detecting statistical shifts compared to a baseline, such as the training data. While data drift can be a root cause of performance degradation, this process monitors the inputs, not the model's predictive accuracy against ground truth labels.
• D. This describes Bias or Fairness Monitoring. The goal is to ensure that a model's performance and predictions are equitable across different demographic or user subgroups. This is a crucial aspect of responsible AI but is distinct from monitoring the overall predictive performance of the model as specified in the scenario.

Correct answer: C — Infrastructure monitoring

• A. Incorrect. Business quality monitoring focuses on the model's impact on business outcomes and key performance indicators (KPIs), such as revenue, conversion rates, or customer satisfaction. The alarm described is based on a technical metric (latency), not a direct business metric.
• B. Incorrect. Data quality monitoring involves tracking the statistical characteristics and integrity of the input data being sent to the model. This includes monitoring for issues like missing values, schema changes, or feature distribution drift. Endpoint latency is a performance metric, not a data quality metric.
• C. Correct. Infrastructure monitoring, also known as operational monitoring, focuses on the health and performance of the serving infrastructure. This includes tracking operational metrics such as latency, throughput, CPU/memory utilization, and error rates. A `ModelLatency` alarm is a classic infrastructure monitoring signal that indicates potential resource constraints or scaling issues.
• D. Incorrect. Model quality monitoring is concerned with the predictive performance of the model itself over time. It involves tracking metrics related to the model's accuracy, such as precision, recall, F1-score, or detecting concept drift. The alarm in the scenario measures how fast the endpoint responds, not how accurate its predictions are.

Correct answer: B — Check for recent changes to the model or configuration -> Analyze Amazon CloudWatch metrics for the endpoint -> Update the endpoint configuration with a larger instance type or more instances.

• A. This sequence is incorrect. While analyzing metrics is a crucial part of troubleshooting, it should not be the first step. The most efficient initial action is to check for recent changes, as a recent deployment is a common cause of new issues and can often be resolved quickly with a rollback.
• B. This sequence represents the most systematic and cost-effective troubleshooting methodology. The first step is to check for recent changes (e.g., code deployments, model updates), as they are a frequent cause of performance degradation. If no changes are identified, the next step is to analyze CloudWatch metrics (like `ModelLatency`, `CPUUtilization`, `Invocations`) to perform a data-driven diagnosis of the bottleneck. Based on this analysis, the final step is to take a targeted corrective action, such as scaling the endpoint up (larger instance) or out (more instances).
• C. This approach is incorrect because it involves taking corrective action (scaling the endpoint) before gathering data or understanding the context. This can lead to increased costs without solving the root cause. For example, scaling up would be ineffective if the issue was a bug in a recent deployment. Troubleshooting should be data-driven, not based on guesswork.
• D. This option is incorrect as it proposes the most drastic and time-consuming action first. Retraining a model is a significant effort and should only be considered a last resort after infrastructure and code-level optimizations have been exhausted. It is not an appropriate initial step for troubleshooting a sudden latency increase.

Correct answer: C — The request has exceeded the AWS account's Service Quota for concurrent training jobs.

• A. Incorrect. If the IAM role lacked the necessary permissions, the error message would typically be an 'AccessDenied' or a similar authorization-related error, not one indicating a limit was exceeded. The failure would be due to insufficient privileges, not resource capacity.
• B. Incorrect. A missing S3 bucket for model artifacts would result in an error like 'BucketNotFound' or a storage path validation failure. This error would likely occur when a training job attempts to write its output, not as an immediate failure when launching the parent hyperparameter tuning job.
• C. Correct. AWS accounts have default Service Quotas (formerly service limits) for various resources, including the number of concurrent training jobs that can run in Amazon SageMaker. Launching 50 concurrent jobs is likely to exceed the default quota for many instance types. The error message 'limit was exceeded' is the exact indicator that this quota has been hit. The solution is to request a quota increase through the AWS Service Quotas console.
• D. Incorrect. A bug in the model container would cause individual training jobs to fail during execution, after they have started. The status of such a job would show a runtime or container-related error (e.g., 'AlgorithmError' or 'Container crashed'). This would not prevent the hyperparameter tuning job from being accepted and attempting to launch its child training jobs.

Correct answer: B — An Amazon CloudWatch Dashboard.

• A. Incorrect. AWS Trusted Advisor provides high-level recommendations on cost optimization, security, performance, and fault tolerance based on AWS best practices. It does not provide a real-time, customizable dashboard for monitoring specific operational metrics like `ModelLatency` or `CPUUtilization` from SageMaker endpoints.
• B. Correct. Amazon CloudWatch is the native AWS monitoring service. A CloudWatch Dashboard allows users to create custom, consolidated views by adding widgets that display metrics from various AWS services. This is the ideal solution for aggregating key performance indicators like `ModelLatency`, `Invocations`, and `CPUUtilization` from multiple SageMaker endpoints into a single, unified view for easy monitoring.
• C. Incorrect. SageMaker Model Monitor is a specialized tool for detecting data quality issues, data drift, and model quality drift by analyzing the data sent to an endpoint. It is not designed for creating a consolidated dashboard of endpoint infrastructure and performance metrics like invocation latency or CPU usage across multiple endpoints.
• D. Incorrect. AWS Cost Explorer is a financial management tool used to visualize, understand, and manage AWS costs and usage over time. It does not provide real-time operational metrics related to the performance of SageMaker endpoints, such as latency or CPU utilization.

Correct answer: C — Use IAM policy condition keys like `aws:RequestTag/Project` and `aws:RequestTag/CostCenter` to enforce the presence of these tags.

• A. This approach is incorrect. A Lambda function triggered by an event like `CreateTrainingJob` (e.g., via Amazon EventBridge) is a reactive measure. It runs after the training job has already been created, so it cannot deny the initial request or enforce the presence of tags at creation time. This method is suitable for remediation, not prevention.
• B. This is incorrect because S3 bucket policies govern access to S3 objects and prefixes within that specific bucket. While they can enforce tagging on objects being uploaded to S3, they have no control over the SageMaker `CreateTrainingJob` API call or the tags applied to the SageMaker training job resource itself.
• C. This is the correct solution. AWS IAM policies are the standard mechanism for controlling permissions for API actions. By using condition keys such as `aws:RequestTag/Project` and `aws:RequestTag/CostCenter` in an IAM policy attached to the relevant users or roles, you can enforce that the `sagemaker:CreateTrainingJob` API call must include these specific tags. If the tags are missing, the API call is denied before the resource is created.
• D. This is not a comprehensive enforcement mechanism. While SageMaker Projects can automatically apply a standard set of tags to resources created *within* that project's context, it does not enforce this rule across the entire AWS account. A user could still create a SageMaker training job outside of a project, thereby bypassing this tagging convention.

Correct answer: D — In the Development account, create an IAM role that the Production account can assume, granting it read access to the S3 model artifact.

• A. This is the second step in the standard cross-account role assumption process. The SageMaker execution role in the Production account must be granted `sts:AssumeRole` permissions, but this can only be done after the target role in the Development account (described in option D) has been created.
• B. This describes an alternative approach using a resource-based policy (S3 bucket policy) to grant cross-account access. While this is a valid method, it is a different pattern from the identity-based role assumption method described by steps A, D, and C. In the context of arranging the other steps into a sequence, this option represents a different path and is not part of the primary sequence.
• C. This is the final step in the workflow. The SageMaker model in the Production account can only be created once all the necessary IAM roles and policies have been correctly configured in both the Development and Production accounts to allow access to the model artifact.
• D. This is the correct first step. To securely grant cross-account access, the account owning the resource (the Development account) must first create an IAM role. This role's permissions policy grants access to the S3 artifact (`s3:GetObject`), and its trust policy explicitly allows the SageMaker execution role from the Production account to assume it.

Correct answer: B — It allows a user to pass an IAM role to an AWS service (like SageMaker) that will then be assumed by that service.

• A. Incorrect. The `iam:PassRole` permission is not used for creating new IAM roles. The permission required to create a role is `iam:CreateRole`. `iam:PassRole` only applies to passing an existing role to a service.
• B. Correct. The `iam:PassRole` permission is a security control that allows a user to pass a specific IAM role to an AWS service, like Amazon SageMaker. When a user creates a SageMaker resource (e.g., a training job or an endpoint), SageMaker needs to perform actions on other AWS resources (like reading from S3 or writing to CloudWatch Logs). This permission ensures the user is authorized to grant the permissions contained within that role to the SageMaker service, which then assumes the role to execute the tasks.
• C. Incorrect. Passing roles between different AWS accounts is managed via cross-account trust relationships in the role's trust policy and typically involves the `sts:AssumeRole` action. `iam:PassRole` is used to delegate permissions to an AWS service within the same account.
• D. Incorrect. An IAM user switching roles within the AWS Management Console relies on the `sts:AssumeRole` permission being granted in the target role's trust policy. `iam:PassRole` is for allowing a service to assume a role on your behalf, not for a user to interactively switch their own role.