AWS ML Engineer – Associate (MLA-C01) — Free Sample Questions
Practice with 30 free ML Engineer Associate questions focused on building production ML systems on AWS using SageMaker, feature stores, and MLOps pipelines.
Exam Domains
- Data Preparation for ML (28%) — Feature Store, data wrangling in SageMaker, handling imbalanced datasets, feature engineering
- ML Model Development (26%) — built-in algorithms (XGBoost, Linear Learner), hyperparameter tuning, model evaluation metrics
- Deployment and Orchestration (22%) — SageMaker endpoints, multi-model endpoints, SageMaker Pipelines, A/B testing
- ML Solution Monitoring and Maintenance (24%) — Model Monitor, data drift detection, retraining triggers, endpoint auto-scaling
What MLA-C01 Tests
This exam bridges data science and engineering. You must know:
- When to use SageMaker built-in algorithms vs. custom containers
- How to set up SageMaker Pipelines with conditional steps and model approval
- Feature Store online vs. offline stores and when each applies
- Model Monitor baselines, constraints, and alerting
- Multi-model vs. multi-container endpoint trade-offs
Recommended Study Order
- Master SageMaker's training job lifecycle: input channels, instance types, output paths
- Understand MLOps: model registry, approval workflows, pipeline triggers
- Study deployment patterns: real-time, batch transform, asynchronous inference
- Practice monitoring: data quality, model quality, bias, and feature attribution drift
Full Preparation Path
Continue with 600 MLA-C01 questions — 30 quizzes and 2 full-length exams — each mapped to official task statements.
All 30 Free Sample Questions
Question 1 — Domain 1: Data Preparation for Machine Learning (ML)
A data scientist needs to choose a file format for storing 10 TB of structured tabular data that will be queried frequently using SQL. The data has many columns but queries typically access only a few columns at a time. Which format provides the best performance and cost efficiency?
- JSON
- Avro
- CSV
- Parquet — Correct answer
Explanation:
- Why correct: Parquet is a columnar format that stores data column-by-column, so queries that access only a few columns skip irrelevant data entirely. This dramatically reduces I/O for selective SQL queries. Parquet also uses efficient encoding and compression (e.g., dictionary, run-length), reducing the 10 TB storage footprint and lowering costs.
- Why A is wrong: JSON is a row-oriented, text-based format with verbose syntax (repeated key names per record). Querying a few columns still requires parsing entire JSON objects, resulting in far more I/O and slower performance than Parquet at this scale.
- Why B is wrong: Avro is a compact row-based format that excels at write-heavy workloads and schema evolution. However, because it is row-oriented, reading a few columns still requires scanning full rows, making it less efficient than Parquet for column-selective analytical queries.
- Why C is wrong: CSV is a row-based, plain-text format with no built-in compression or schema enforcement. At 10 TB, CSV files are large, slow to scan, and require reading entire rows even when only a few columns are needed.
- Why D is correct: This is the correct answer.
Question 2 — Domain 1: Data Preparation for Machine Learning (ML)
A company stores features in SageMaker Feature Store. The feature ingestion pipeline occasionally writes duplicate records with the same event time. How does Feature Store handle this scenario?
- Feature Store rejects all duplicate records and raises an error
- Feature Store stores all duplicates and returns random values on query
- Feature Store uses the record identifier and event time as a composite key; duplicates overwrite previous values — Correct answer
- Feature Store automatically deduplicates based on record content
Explanation:
- Why correct: SageMaker Feature Store uses the record identifier and event time as a composite key. When a new record is ingested with the same record identifier and event time, the previous value is overwritten. In the online store, only the latest value is kept. In the offline store, both old and new records are appended to S3, but time-travel queries and the Feature Store API resolve to the latest event time per record.
- Why A is wrong: Feature Store does not reject duplicates or raise errors. It is designed to accept updates by overwriting records that share the same record identifier and event time, which supports correction workflows.
- Why B is wrong: Feature Store does not store multiple duplicate values and return random ones. The online store always returns the most recent record for a given identifier, and offline store queries resolve deterministically based on event time.
- Why D is wrong: Feature Store does not perform content-based deduplication (e.g., hashing field values). It relies solely on the record identifier and event time as the key. Two records with different content but the same key will still result in an overwrite.
Question 3 — Domain 1: Data Preparation for Machine Learning (ML)
A machine learning team receives new training data weekly from multiple upstream systems. Before each training run, the team must verify that the data meets quality standards including no missing required fields, no duplicate records, and all numerical features within expected ranges. The solution must be automated and require minimal custom code. Which TWO approaches should the team use together?
- Use Amazon Athena to query the data and manually inspect sample rows for anomalies
- Create AWS Glue Data Quality rules to automatically validate completeness, uniqueness, and value ranges on each incoming batch — Correct answer
- Write a custom AWS Lambda function that scans every record and logs issues to Amazon CloudWatch
- Load the data directly into SageMaker training and rely on model metrics to surface data problems
- Use Amazon Macie to scan for data quality issues such as missing values and duplicates
- Use AWS Glue DataBrew profile jobs to generate statistical summaries and flag columns that violate expected distributions before the data enters the pipeline — Correct answer
Explanation:
- Why correct: AWS Glue Data Quality provides a declarative rule language (DQDL) that lets you define rules for completeness, uniqueness, and value ranges, then automatically evaluates incoming data against those rules with pass/fail results — requiring minimal custom code. DataBrew profile jobs generate statistical summaries (mean, min, max, distribution, missing-value counts) for every column, letting the team detect distribution shifts or unexpected patterns before training. Together, they provide automated rule-based validation plus statistical profiling.
- Why A is wrong: Athena queries can check data, but manual inspection does not scale and is not automated. It requires writing and maintaining individual SQL queries for each check.
- Why C is wrong: A custom Lambda function requires significant development, testing, and maintenance effort. Glue Data Quality and DataBrew provide these capabilities out of the box with minimal code.
- Why D is wrong: Loading unvalidated data into training wastes compute resources and can produce a degraded model. Data quality problems should be caught before training begins, not discovered through poor model metrics after the fact.
- Why E is wrong: Amazon Macie is a security service that discovers and protects sensitive data (PII, credentials). It does not validate data quality issues such as missing values, duplicates, or range violations.
Question 4 — Domain 1: Data Preparation for Machine Learning (ML)
A dataset contains a categorical feature with 50 unique values. The feature will be used in a tree-based model (Random Forest). Which encoding is most appropriate?
- No encoding needed
- Label encoding (assigning each category a unique integer) — Correct answer
- Target encoding only
- One-hot encoding creating 50 columns
Explanation:
- Why correct: Tree-based models like Random Forest split on numerical thresholds and do not assume ordinal relationships between integer values. This makes label encoding efficient — each category gets a unique integer, and the tree can learn splits that isolate individual categories without the dimensionality explosion of one-hot encoding.
- Why A is wrong: Most ML frameworks require categorical features to be encoded as numerical values before training. Passing raw categorical strings to a Random Forest will cause errors. Label encoding is needed to convert categories to integers.
- Why C is wrong: While target encoding can work for tree-based models, it introduces the risk of target leakage if not applied carefully with proper cross-validation. Label encoding is simpler, has no leakage risk, and works equally well with tree-based models that can split on integer values.
- Why D is wrong: One-hot encoding with 50 unique values creates 50 new binary columns, significantly increasing dimensionality and sparsity. Tree-based models handle label encoding well, so the added dimensionality of one-hot encoding is unnecessary and can slow training.
Question 5 — Domain 2: ML Model Development
A data scientist needs to build two ML models on Amazon SageMaker: one to learn semantic similarity between job descriptions and resumes so recruiters can automatically match candidates to open positions, and another to predict customer churn using structured tabular data with dozens of features. Which TWO SageMaker built-in algorithms are most appropriate for these respective use cases?
- Object2Vec for learning embeddings that capture similarity between job descriptions and resumes — Correct answer
- DeepAR for matching job descriptions to resumes based on time-series patterns
- K-Means for predicting customer churn probability
- Random Cut Forest for predicting customer churn probability
- XGBoost for predicting customer churn probability — Correct answer
Explanation:
- Why correct: Object2Vec is a SageMaker built-in algorithm that learns low-dimensional embeddings for pairs of objects. It can take paired inputs (a job description and a resume) and learn a shared embedding space where semantically similar pairs are close together, enabling similarity scoring for candidate-job matching. XGBoost is a gradient-boosted tree algorithm that excels at structured tabular classification, making it well-suited for churn prediction with many features.
- Why A (Object2Vec) is correct: Object2Vec learns relationships between paired inputs and produces embeddings that capture semantic similarity. This is exactly what is needed to score how well a resume matches a job description.
- Why B (DeepAR) is wrong: DeepAR is a time-series forecasting algorithm. It cannot process text pairs or learn semantic similarity between documents.
- Why C (K-Means) is wrong: K-Means is an unsupervised clustering algorithm. Churn prediction is a supervised classification problem with known labels, so K-Means is not appropriate.
- Why D (Random Cut Forest) is wrong: Random Cut Forest is an unsupervised anomaly detection algorithm. It does not produce churn probability scores from labeled data.
- Why E (XGBoost) is correct: XGBoost handles tabular data with mixed feature types, provides feature importance, and consistently performs well on structured classification problems like churn prediction.
Question 6 — Domain 2: ML Model Development
An ML engineer is training a deep learning model on SageMaker. Training runs for 100 epochs but the validation loss stops improving after approximately 20 epochs. The remaining 80 epochs waste compute resources without improving the model. Which approach most effectively reduces training time while preserving model quality?
- Set the number of epochs to 5 and disable validation entirely to save time
- Configure early stopping with a patience of 5 epochs monitoring validation loss, so training stops when the model stops improving — Correct answer
- Manually monitor training logs and terminate the job from the SageMaker console when loss appears flat
- Reduce the learning rate to a very small value so the model converges more slowly but precisely
Explanation:
- Why correct: Early stopping monitors a validation metric (such as validation loss) and halts training after a specified number of epochs (patience) with no improvement. This prevents unnecessary training epochs, saving compute time and cost, while also helping to avoid overfitting. A patience of 5 epochs gives the model a reasonable window to recover from temporary plateaus before stopping.
- Why A is wrong: Disabling validation removes the ability to detect overfitting or convergence. Setting a fixed low epoch count may undertrain the model or still overtrain it if 5 epochs are too many or too few.
- Why C is wrong: Manual monitoring is error-prone, doesn't scale, and requires constant human attention. Early stopping automates this process reliably.
- Why D is wrong: Reducing the learning rate makes convergence slower, which increases training time rather than reducing it. This does not address the goal of stopping training when the model stops improving.
Question 7 — Domain 2: ML Model Development
A machine learning engineer is building a fraud detection model using SageMaker. The dataset is imbalanced with only 5% of transactions being fraudulent. During evaluation, the model shows 95% accuracy but fails to catch most fraudulent transactions. Which metric should the engineer prioritize to better evaluate model performance?
- Accuracy
- Precision only
- F1 score — Correct answer
- Training loss
Explanation:
- Why correct: With an imbalanced dataset (5% fraudulent), accuracy is misleading because a model that predicts 'not fraud' for every transaction would achieve 95% accuracy. The F1 score is the harmonic mean of precision and recall, making it sensitive to both false positives and false negatives. This gives a more balanced view of model performance on the minority class.
- Why A is wrong: Accuracy measures overall correctness but is misleading on imbalanced datasets. A naive model predicting the majority class for every instance would score 95% accuracy while catching zero fraud cases.
- Why B is wrong: Precision alone only measures how many predicted fraud cases are actually fraud. It does not account for missed fraud cases (false negatives). A model could have perfect precision by being extremely conservative but miss most fraud.
- Why D is wrong: Training loss measures how well the model fits the training data during optimization. It does not measure prediction quality on unseen data and does not reflect real-world performance on the minority class.
Question 8 — Domain 2: ML Model Development
A warehouse company wants to use camera images to automatically identify products on shelves and record each product's location within the image. Which SageMaker built-in algorithm should the team select?
- Image Classification algorithm
- Object Detection algorithm — Correct answer
- Linear Learner algorithm
- BlazingText algorithm
Explanation:
- Why B is correct: The SageMaker Object Detection algorithm detects objects within an image and returns bounding boxes with class labels and confidence scores. This is exactly what is needed to identify each product and its shelf location in warehouse images.
- Why A is wrong: Image Classification assigns a single label to an entire image (e.g., 'warehouse' or 'shelf') but does not locate individual objects within the image. The company needs both identification and location of each item.
- Why C is wrong: Linear Learner is designed for regression and classification tasks on structured/tabular data. It cannot process image data or detect objects.
- Why D is wrong: BlazingText is designed for text classification (supervised mode) and generating word embeddings (unsupervised mode). It has no image processing capability.
Question 9 — Domain 3: Deployment and Orchestration of ML Workflows
An e-commerce company needs to generate personalized product recommendations for its entire catalog of 500,000 items every night. The results are stored in Amazon S3 and served to customers the next day. Which deployment approach is the MOST cost-effective?
- Deploy a SageMaker real-time endpoint behind an Application Load Balancer
- Use SageMaker batch transform to process nightly product catalog updates — Correct answer
- Deploy to AWS Lambda with Amazon API Gateway for synchronous scoring
- Use Amazon Kinesis Data Streams to buffer requests before a SageMaker endpoint
Explanation:
- Why correct: SageMaker batch transform is designed for offline, high-throughput inference on large datasets without needing a persistent endpoint. A nightly product catalog update is a classic batch workload — the data is collected, processed in bulk, and the results are stored in S3. This is cost-efficient because compute is provisioned only for the duration of the job.
- Why A is wrong: A real-time endpoint runs continuously and is designed for low-latency, on-demand predictions. Using it for a scheduled nightly batch job wastes resources during idle hours and is significantly more expensive than a batch transform job.
- Why C is wrong: Lambda with API Gateway is suited for synchronous, on-demand scoring of individual requests. Processing an entire product catalog through individual Lambda invocations would be slow, complex to orchestrate, and more expensive than a single batch transform job.
- Why D is wrong: Kinesis Data Streams is a real-time data streaming service designed for continuous data ingestion, not scheduled batch processing. It adds unnecessary architectural complexity for a nightly batch workload.
Question 10 — Domain 3: Deployment and Orchestration of ML Workflows
A team of ML engineers needs to provision a repeatable ML pipeline that includes SageMaker training jobs, endpoints, and S3 buckets across multiple environments. The team wants to use familiar programming constructs such as loops and conditionals to reduce template repetition. Which approach should the team use?
- Use AWS CloudFormation because it provides declarative YAML/JSON templates and is natively supported across all AWS services without additional dependencies
- Use AWS CDK because it allows defining infrastructure in general-purpose programming languages like Python, enabling loops, conditionals, and reuse of constructs — Correct answer
- Use the AWS Management Console to manually create all resources so the team can visually inspect each setting
- Use shell scripts that call the AWS CLI to provision each resource sequentially
Explanation:
- Why correct: AWS CDK lets the team define infrastructure using familiar programming languages (Python, TypeScript, Java, etc.), which supports loops, conditionals, object-oriented abstractions, and reusable constructs. For complex ML pipelines with many similar resources, CDK reduces boilerplate and is easier for a development team to maintain. CDK synthesizes to CloudFormation under the hood, so the team still gets CloudFormation's reliability.
- Why A is wrong: CloudFormation templates work well but can become verbose and repetitive for complex ML pipelines with many similar components. CDK provides a higher-level abstraction that generates CloudFormation, combining the benefits of both approaches with better maintainability for development teams.
- Why C is wrong: Manual Console provisioning is not repeatable, not version-controllable, and prone to human error. Infrastructure as Code (IaC) is essential for reproducible ML environments.
- Why D is wrong: Shell scripts with AWS CLI are imperative and lack built-in state management, rollback, drift detection, and dependency resolution that IaC tools like CloudFormation and CDK provide.
Question 11 — Domain 3: Deployment and Orchestration of ML Workflows
A company is deploying an updated fraud detection model to a SageMaker real-time endpoint that serves production traffic. The team wants all traffic to cut over to the new model at once after pre-traffic validation, rather than shifting traffic gradually. If the new model underperforms in production, they need the ability to instantly revert 100% of traffic to the previous model version. Which deployment strategy should they configure in their CI/CD pipeline?
- Canary deployment with a 10% initial traffic shift
- Blue/green deployment with automatic rollback enabled — Correct answer
- Linear deployment shifting 10% traffic every 10 minutes
- In-place deployment with a post-deployment validation step
Explanation:
- Why correct: Blue/green deployment maintains two full environments simultaneously — the current production (blue) and the new version (green). After pre-traffic validation (e.g., a BeforeAllowTraffic Lambda hook), all traffic is shifted to the green environment at once. Because the blue environment remains running on standby, traffic can be instantly rerouted back to it if the new model underperforms, providing immediate full rollback with zero downtime. This matches the team's requirements: full cutover (not gradual) plus instant revert.
- Why A is wrong: Canary deployment sends only a small percentage of traffic (e.g., 10%) to the new model first, then shifts the remaining traffic after a monitoring period. While canary does support instant rollback at any point during the deployment, it does not meet the team's requirement to cut over all traffic at once. Canary is designed for gradual validation, not immediate full-traffic cutover.
- Why C is wrong: Linear deployment shifts traffic in equal increments at regular intervals (e.g., 10% every 10 minutes). Like canary, it is a gradual strategy — traffic reaches 100% only after multiple intervals. This contradicts the team's requirement for an all-at-once cutover.
- Why D is wrong: An in-place deployment updates the existing endpoint directly, replacing the old model. If the new model fails, there is no standby environment to switch back to — the team would need to redeploy the previous model from scratch, causing downtime and delay. This does not provide instant rollback.
Question 12 — Domain 3: Deployment and Orchestration of ML Workflows
A company needs to deploy a TensorFlow image classification model to IoT devices with limited compute and memory. The model must run with low latency directly on the device hardware. Which AWS service should the team use to optimize the model for edge deployment?
- SageMaker Inference Recommender
- SageMaker Neo — Correct answer
- AWS IoT Greengrass without model compilation
- SageMaker Model Registry
Explanation:
- Why correct: SageMaker Neo compiles ML models to optimize them for specific target hardware (e.g., ARM, Intel, NVIDIA edge devices). Neo uses compilation techniques to reduce model size and improve inference speed without significant accuracy loss, making it purpose-built for deploying models to resource-constrained edge devices.
- Why A is wrong: SageMaker Inference Recommender benchmarks models across different SageMaker endpoint instance types to find cost-performance tradeoffs. It is designed for cloud-based endpoint selection, not for compiling or optimizing models to run on edge hardware.
- Why C is wrong: AWS IoT Greengrass enables running Lambda functions and ML inference at the edge, but it does not optimize or compile the model itself. Neo is needed first to compile the model, which can then be deployed via Greengrass.
- Why D is wrong: SageMaker Model Registry stores and versions models but does not compile or optimize them for target hardware. It is a model governance tool, not a model optimization tool.
Question 13 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A company wants to implement comprehensive monitoring for their production ML model on SageMaker. Which THREE types of monitoring should they configure using SageMaker Model Monitor? (Choose three.)
- Data quality monitoring to detect drift in input feature distributions — Correct answer
- Model quality monitoring to track prediction accuracy against ground truth — Correct answer
- Network throughput monitoring to measure VPC bandwidth utilization
- Bias drift monitoring to detect changes in model fairness over time — Correct answer
- GPU temperature monitoring to prevent hardware overheating
- Auto Scaling monitoring to track instance count changes
Explanation:
- Why correct (A - Data quality monitoring): SageMaker Model Monitor's data quality monitoring compares incoming inference data against a training baseline to detect statistical drift in feature distributions, missing values, and schema changes.
- Why correct (B - Model quality monitoring): Model quality monitoring tracks prediction accuracy metrics (e.g., accuracy, F1, RMSE) by comparing model predictions against collected ground truth labels, alerting when performance degrades.
- Why correct (D - Bias drift monitoring): SageMaker Clarify integrated with Model Monitor can detect changes in bias metrics over time, ensuring the model maintains fairness as production data evolves.
- Why C is wrong: Network throughput is an infrastructure metric managed by VPC Flow Logs and CloudWatch, not an ML-specific monitoring concern addressed by Model Monitor.
- Why E is wrong: GPU temperature is a hardware concern managed by the underlying infrastructure, not a model monitoring capability of SageMaker Model Monitor.
- Why F is wrong: Auto Scaling metrics are operational infrastructure concerns tracked by CloudWatch and SageMaker endpoint auto-scaling policies, not part of Model Monitor's ML-specific monitoring.
Question 14 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A machine learning team has been running multiple SageMaker training jobs over the past quarter using various instance types. The team lead wants to understand which instance types are driving the highest costs. Which approach provides this cost visibility with the LEAST effort?
- Use AWS CloudTrail to filter training job costs by instance type
- Use AWS Cost Explorer to group costs by service and instance type over the past quarter — Correct answer
- Use Amazon CloudWatch metrics to identify the most expensive training instance types
- Build a custom dashboard in Amazon QuickSight connected to SageMaker training logs
Explanation:
- Why correct (B): AWS Cost Explorer allows you to filter and group costs by service, instance type, linked account, and custom tags. By grouping SageMaker costs by instance type and filtering by date range, the team can identify which training jobs on which instance families consumed the most budget. Cost Explorer also supports forecasting to project future spend.
- Why A is wrong: AWS CloudTrail logs API calls (who did what and when) but does not provide cost breakdowns or spending analysis. It is an auditing tool, not a cost analysis tool.
- Why C is wrong: Amazon CloudWatch monitors performance metrics (CPU, memory, invocation latency) but does not provide cost or billing information. It cannot show which instance types drove the highest spend.
- Why D is wrong: Amazon QuickSight is a business intelligence and visualization tool. While it could visualize cost data if connected to a cost data source, it does not natively integrate with AWS billing data the way Cost Explorer does. Using QuickSight would require additional setup (e.g., exporting Cost and Usage Reports to S3 first), adding unnecessary complexity for this use case.
Question 15 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A company's compliance policy requires that SageMaker training jobs do not have direct internet access and that all data remains within the corporate network. The training jobs need to access training data in S3 and write logs to CloudWatch. Which configuration meets these requirements?
- Run training jobs in the default SageMaker-managed network configuration with no VPC settings
- Place training jobs in a private subnet with no internet access and create VPC endpoints for S3 and CloudWatch — Correct answer
- Place training jobs in a public subnet with an internet gateway and use security groups to block all outbound traffic
- Disable network access entirely on the training jobs and upload data manually to the instance before training starts
Explanation:
- Why correct (B): Running SageMaker training jobs in a private subnet with VPC endpoints for S3 (gateway endpoint) and CloudWatch Logs (interface endpoint) keeps all traffic within the AWS network — no internet access is needed. This satisfies the compliance requirement of no direct internet access while still allowing the job to read data and write logs.
- Why A is wrong: The default SageMaker network configuration provides internet access through a SageMaker-managed VPC. The training containers can reach the public internet, which violates the compliance requirement.
- Why C is wrong: A public subnet with an internet gateway inherently provides internet routing. Security groups are stateful and only filter inbound/outbound rules, but placing resources in a public subnet with an IGW contradicts the 'no direct internet access' requirement.
- Why D is wrong: You cannot manually upload data to SageMaker training instances. SageMaker manages the instance lifecycle. The job needs network access to pull data from S3 — VPC endpoints provide this without internet access.
Question 16 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A recommendation engine deployed on SageMaker has seen a 15% drop in accuracy over two months. The data science team wants to understand which input features have changed most significantly compared to the training data before deciding on a remediation strategy. Which approach best addresses this requirement?
- Use SageMaker Clarify to analyze feature attribution shifts between training data and live inference data — Correct answer
- Increase the endpoint instance count to handle more requests and reduce latency
- Redeploy the same model artifact to a new endpoint with a different instance type
- Add more features to the model and retrain immediately without investigating the root cause
Explanation:
- Why correct: SageMaker Clarify can detect changes in feature attribution and data distribution between the training baseline and live inference traffic. By analyzing which features have shifted, the team can determine whether the accuracy drop is caused by concept drift, data drift, or specific feature distribution changes, enabling targeted remediation.
- Why B is wrong: Increasing instance count addresses throughput and latency, not model accuracy degradation. The problem is the quality of predictions, not infrastructure capacity.
- Why C is wrong: Redeploying the same model artifact to a different instance type does not change model behavior. The model weights and logic remain identical, so predictions will not improve.
- Why D is wrong: Adding more features and retraining without root cause analysis may not fix the issue and could introduce noise. The team should first understand what changed in the data before deciding on a retraining strategy.
Question 17 — Domain 1: Data Preparation for ML
A data engineering team builds features for a real-time fraud detection model. The features must be available for both model training from historical data and for low-latency inference lookups during live transactions. The team wants a single managed solution to avoid feature skew between training and serving. Which approach should they use?
- Store features in separate S3 datasets for training and DynamoDB tables for serving, with a Lambda function to keep them synchronized
- Use Amazon SageMaker Feature Store with both online and offline stores enabled for the feature group — Correct answer
- Cache features in Amazon ElastiCache for real-time lookups and export snapshots to S3 for training
- Load features into Amazon Redshift and query them for both training and real-time inference
Explanation:
- Why correct: Amazon SageMaker Feature Store provides both an offline store (backed by S3 for batch training queries via Athena) and an online store (low-latency key-value lookups for real-time inference). Using a single Feature Store feature group ensures training and serving use the same feature definitions and transformations, eliminating feature skew.
- Why A is wrong: Maintaining separate S3 datasets for training and a DynamoDB table for serving requires custom synchronization logic. Any drift between the two stores introduces training-serving skew, which is exactly what the team wants to avoid.
- Why C is wrong: Amazon ElastiCache provides low-latency caching but is not a feature management solution. It does not provide an integrated offline store for training, so the team would still need to maintain separate feature pipelines and risk skew.
- Why D is wrong: Amazon Redshift is an analytics data warehouse optimized for complex queries, not low-latency single-record lookups needed during real-time inference. It also does not natively integrate with SageMaker as a feature store.
Question 18 — Domain 1: Data Preparation for Machine Learning
An ML team processes clickstream data arriving at a rate of 50,000 events per second. They need to enrich each event with user-profile data from DynamoDB, apply sessionization logic, and write the results to Amazon S3 in near real-time for downstream model training. Which service best meets these requirements?
- Amazon Kinesis Data Firehose with a Lambda transformation function
- AWS Glue Streaming ETL job reading from Kinesis Data Streams
- Amazon EMR running a Spark Structured Streaming job
- Amazon Managed Service for Apache Flink reading from Kinesis Data Streams — Correct answer
Explanation:
- Why correct: Amazon Managed Service for Apache Flink (formerly Kinesis Data Analytics for Apache Flink) is purpose-built for complex stateful stream processing. It natively supports sessionization (session windows), external lookups for enrichment, and can handle high-throughput streams with low latency. It writes results to S3 via sinks with exactly-once semantics.
- Why A is wrong: Kinesis Data Firehose with Lambda can do simple transformations, but Lambda has a 15-minute timeout and 6 MB payload limit. Sessionization requires maintaining state across events, which is not possible with stateless Lambda invocations. Firehose is better suited for simple delivery and format conversion.
- Why B is wrong: AWS Glue Streaming ETL can handle streaming data, but it has higher startup latency (cold start of Spark clusters) and is less optimized for complex stateful operations like sessionization compared to Flink. Glue Streaming is better for simpler streaming ETL patterns.
- Why C is wrong: EMR with Spark Structured Streaming can technically do this, but it requires managing cluster infrastructure, scaling, and checkpointing manually. The question asks for a near real-time solution — Flink provides lower latency than Spark's micro-batch model and is fully managed.
Question 19 — Domain 3: Deployment and Orchestration of ML Workflows
A company wants to deploy a computer vision model for real-time inference at scale. The model requires hardware acceleration and must handle thousands of concurrent requests cost-effectively. Which TWO deployment architectures should an ML engineer evaluate?
- Deploy on a single p5.48xlarge instance and scale vertically if needed
- Deploy on Amazon ECS with Fargate using ARM-based tasks
- Deploy on Amazon ECS with EC2 launch type using Inf2 instances behind a Network Load Balancer — Correct answer
- Deploy on AWS Lambda with provisioned concurrency
- Deploy on Amazon EC2 G5 instances with an Application Load Balancer — Correct answer
Explanation:
- Why C is correct: Inf2 instances use AWS Inferentia2 chips, which are purpose-built for ML inference and offer up to 4x higher throughput and 10x lower cost compared to comparable GPU instances. Running them as ECS tasks on EC2 launch type gives full control over instance selection, and NLB provides high-performance, low-latency routing ideal for real-time inference.
- Why E is correct: G5 instances with A10G GPUs are well-suited for ML inference workloads that require GPU acceleration but may not benefit from Inferentia (e.g., custom operators). ALB supports path-based routing, health checks, and is commonly used for HTTP-based inference endpoints. This provides a strong GPU-based inference option.
- Why A is wrong: A p5.48xlarge is a high-end training instance with 8x H100 GPUs. Using it for inference is extremely cost-inefficient. Inference workloads typically need right-sized instances, not the largest training instances.
- Why B is wrong: Fargate does not support GPU or Inferentia accelerators. ML inference models that require hardware acceleration cannot run on Fargate ARM tasks. Fargate is suitable for CPU-only workloads.
- Why D is wrong: Lambda has a 10 GB container image size limit, 10 GB memory limit, and a 15-minute execution timeout. These constraints make it unsuitable for serving large ML models that require GPU acceleration and sustained throughput.
Question 20 — Domain 1: Data Preparation for Machine Learning
A data science team runs distributed training jobs on Amazon SageMaker that require a shared file system with sub-millisecond latency and high throughput. The training data consists of millions of small image files totaling 10 TB. Which storage solution is MOST appropriate?
- Amazon EFS in General Purpose mode
- Amazon FSx for Lustre linked to an S3 bucket — Correct answer
- Amazon S3 with S3 Transfer Acceleration enabled
- Amazon EBS volumes attached to each training instance
Explanation:
- Why correct (B): Amazon FSx for Lustre is a high-performance parallel file system designed for compute-intensive workloads like ML training. It provides sub-millisecond latencies and hundreds of GB/s throughput. When linked to an S3 bucket, it automatically hydrates data from S3 on first read and can write results back to S3, combining high performance with S3 durability.
- Why A is wrong: Amazon EFS General Purpose mode provides millisecond latencies, not sub-millisecond. While EFS supports shared access, it is not optimized for the high-throughput, low-latency parallel I/O patterns required by distributed ML training on millions of small files.
- Why C is wrong: S3 Transfer Acceleration speeds up transfers over long geographic distances by routing through CloudFront edge locations. It does not provide a POSIX file system interface or sub-millisecond latency needed for distributed training jobs reading millions of small files.
- Why D is wrong: Amazon EBS volumes are block storage attached to a single EC2 instance and cannot be shared across multiple training instances simultaneously. Each instance would need its own copy of the data, which is inefficient and does not provide a shared file system.
Question 21 — Domain 3: Deployment and Orchestration of ML Workflows
A company wants to automatically trigger a model evaluation Lambda function whenever a SageMaker training job completes successfully. The solution must require no custom polling code and should support filtering by training job status. Which approach should an ML engineer use?
- Configure Amazon EventBridge to capture SageMaker training job state change events and route successful completions to the Lambda function — Correct answer
- Set up an Amazon SQS queue that polls the SageMaker API every minute for job status changes
- Use Amazon SNS to subscribe to SageMaker training logs in CloudWatch
- Create a cron job in Amazon MWAA to check training job status periodically
Explanation:
- Why correct: SageMaker natively emits training job state change events to Amazon EventBridge. An EventBridge rule can filter these events by status (e.g., 'Completed') and route only successful completions to a Lambda function target. This is fully event-driven with zero polling code, and EventBridge's content-based filtering supports matching on the training job status field.
- Why B is wrong: Polling the SageMaker API from SQS is not how SQS works—SQS is a message queue, not a polling engine. This approach would require custom Lambda code to periodically call DescribeTrainingJob, adding unnecessary complexity and latency compared to native EventBridge events.
- Why C is wrong: Amazon SNS cannot subscribe directly to CloudWatch Logs for SageMaker training status. SNS is a notification service that requires a publisher to send messages—it does not independently monitor log streams for status changes.
- Why D is wrong: While MWAA could poll for training status, a cron-based approach introduces unnecessary latency between job completion and detection, requires maintaining an Airflow environment (additional cost and operational overhead), and is not event-driven as the scenario requires.
Question 22 — Domain 2: ML Model Development
An ML engineer needs to automate building a custom Docker container image for SageMaker training jobs as part of a CI/CD pipeline. The image must be pushed to Amazon ECR after each code change. Which AWS service should handle the container build step?
- AWS CodeBuild with a buildspec.yml that runs docker build and pushes the image to Amazon ECR — Correct answer
- AWS CodeDeploy configured to compile the Docker image on the target SageMaker training instance
- Amazon SageMaker Studio to interactively build and tag the container image each time
- AWS CloudFormation to define the Docker image layers as stack resources
Explanation:
- Why correct: CodeBuild is AWS's fully managed continuous integration service that can execute arbitrary build commands defined in a buildspec.yml file. For ML workflows, this means running 'docker build' to create a custom training or inference container, then pushing it to Amazon ECR. CodeBuild integrates natively with CodePipeline, making it the standard CI/CD choice for container builds.
- Why B is wrong: CodeDeploy is a deployment service that deploys applications to compute platforms (EC2, Lambda, ECS). It does not build Docker images—it consumes artifacts that are already built.
- Why C is wrong: SageMaker Studio is an IDE for data scientists. While you can build containers interactively in Studio, this is a manual process that doesn't integrate into an automated CI/CD pipeline.
- Why D is wrong: CloudFormation defines and provisions infrastructure resources declaratively. It can reference an existing ECR image URI in a template, but it cannot execute a Docker build process. Container building requires a compute environment like CodeBuild.
Question 23 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A company runs multiple SageMaker training jobs and real-time endpoints. The security team requires an audit trail of all configuration changes, while the ML operations team needs to troubleshoot failed training jobs quickly. Which TWO actions should the team take to meet both requirements?
- Create a single CloudWatch Alarm on Invocations and rely on it for all monitoring needs
- Use AWS CloudTrail to audit API calls and track who made changes to the ML pipeline configuration — Correct answer
- Use AWS Trusted Advisor to check whether the endpoint instance type is on the recommended list
- Store SageMaker training hyperparameters directly in the training script source code
- Use Amazon CloudWatch Logs Insights to query and analyze SageMaker training job logs for errors — Correct answer
Explanation:
- Why correct: AWS CloudTrail (Option B) records all API calls made to AWS services, providing the audit trail the security team needs — for example, tracking who modified endpoint configurations, changed IAM policies, or deleted training jobs. CloudWatch Logs Insights (Option E) allows the ML operations team to run SQL-like queries against SageMaker training job logs to quickly filter for error messages, aggregate failure patterns, and identify root causes of failed jobs.
- Why A is wrong: A single CloudWatch Alarm on Invocations only monitors one metric and does not provide an audit trail of configuration changes or the ability to query training logs for errors. This addresses neither the security team's nor the operations team's full requirements.
- Why C is wrong: AWS Trusted Advisor provides recommendations on cost optimization, security, fault tolerance, and service limits, but it does not provide an audit trail of API calls or allow querying of training job logs.
- Why D is wrong: Storing hyperparameters in source code makes them harder to audit and manage. AWS Systems Manager Parameter Store or SageMaker Experiments would be better approaches, but this option does not address audit trails or log analysis.
Question 24 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A data science team stores sensitive customer data in Amazon S3 for model training on Amazon SageMaker. A compliance audit requires that all training data be encrypted at rest with a key the team can control and audit. Which approach meets this requirement?
- Enable server-side encryption with Amazon S3-managed keys (SSE-S3) on the bucket
- Disable encryption to avoid performance overhead during training
- Use AWS KMS with a customer managed key and specify the key ARN in the SageMaker training job configuration — Correct answer
- Encrypt data client-side before uploading to S3 using a self-managed OpenSSL key
Explanation:
- Why correct: AWS KMS with a customer managed key (CMK) provides encryption at rest for the S3 bucket storing training data and for the SageMaker training volume. Specifying the KMS key ARN in the SageMaker training job configuration ensures both the input data in S3 and the data on the training instance's EBS volume are encrypted with a key the team controls and can audit.
- Why A is wrong: Server-side encryption with S3-managed keys (SSE-S3) encrypts data in S3 but does not give the team control over the encryption key. The team cannot audit key usage, set key rotation policies, or restrict key access through IAM policies. It also does not address encryption of the SageMaker training volume.
- Why B is wrong: Disabling encryption is a compliance violation for sensitive data. Regulatory frameworks such as HIPAA and GDPR typically require encryption at rest for sensitive datasets.
- Why D is wrong: Client-side encryption before uploading to S3 adds operational complexity for key management and is not natively integrated with SageMaker training jobs. SageMaker cannot automatically decrypt client-side encrypted data, so the training code would need custom decryption logic, making this approach impractical for most ML workflows.
Question 25 — Domain 1: Data Preparation
A data engineer is building a SageMaker Processing job that runs in a private subnet within a VPC. The job must download a Python package from PyPI (an external internet resource) during startup, then write processed feature data to an S3 bucket in the same Region. The company requires that S3 traffic stays on the AWS private network. Which TWO resources should the engineer configure? (Select TWO.)
- An internet gateway with public IP addresses assigned to the processing instances
- A NAT gateway in a public subnet, with the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway — Correct answer
- A VPC Interface Endpoint for PyPI so the package download stays on the AWS backbone
- A VPC Gateway Endpoint for Amazon S3 to keep feature data writes off the public internet — Correct answer
- An AWS Direct Connect connection to PyPI's data center
Explanation:
- Why correct (B + D): The job has two connectivity needs: (1) internet access for PyPI, and (2) private S3 access. A NAT gateway in a public subnet gives instances in the private subnet outbound internet access for the PyPI download while keeping the instances themselves private (no inbound internet access). A VPC Gateway Endpoint for S3 routes S3 traffic through the AWS private network at no additional per-GB cost, satisfying the requirement to keep S3 traffic off the public internet.
- Why A is wrong: Assigning public IPs and routing through an internet gateway would work functionally, but it places the processing instances on the public internet, violating the network isolation principle. The instances would be directly addressable from the internet, increasing the attack surface.
- Why C is wrong: PyPI is a third-party internet service, not an AWS service. VPC Interface Endpoints (AWS PrivateLink) only work with supported AWS services and AWS Marketplace partner services. There is no VPC endpoint for PyPI.
- Why E is wrong: AWS Direct Connect provides a dedicated private connection between an on-premises data center and AWS, not between AWS and arbitrary third-party websites. It cannot be used to connect to PyPI.
Question 26 — Domain 1: Data Preparation for Machine Learning
A healthcare company needs to migrate 500 TB of de-identified patient records from an on-premises data center to Amazon S3 to train a clinical ML model. The facility has a 100 Mbps internet connection, and the ML team needs data available within 2 weeks. Which migration approach should the team choose?
- Use AWS DataSync over the existing 100 Mbps internet connection to transfer data to S3
- Set up an AWS Direct Connect 10 Gbps dedicated connection and then transfer data using DataSync
- Order multiple AWS Snowball Edge Storage Optimized devices, load data on-premises, and ship them to AWS — Correct answer
- Use Amazon S3 Transfer Acceleration to upload data from the on-premises servers
Explanation:
- Why correct: At 100 Mbps, transferring 500 TB over the network would take approximately 463 days, far exceeding the 2-week deadline. AWS Snowball Edge Storage Optimized devices each hold up to 80 TB of usable capacity, so roughly 7 devices can be loaded in parallel on-premises, shipped to AWS, and ingested into S3 within 1-2 weeks. Snowball Edge provides built-in 256-bit encryption and tamper-resistant enclosures for data security during transit.
- Why A is wrong: At 100 Mbps, the theoretical maximum transfer rate is about 1.08 TB per day. Transferring 500 TB would take over 460 days, making it impossible to meet the 2-week deadline even with DataSync optimizations.
- Why B is wrong: While Direct Connect with DataSync would provide high-bandwidth transfer, provisioning a new Direct Connect link typically takes 2-4 weeks or more for physical cross-connect installation, which alone exceeds the 2-week deadline before any data transfer begins.
- Why D is wrong: S3 Transfer Acceleration uses CloudFront edge locations to speed up internet uploads, but it still relies on the 100 Mbps connection as the bottleneck. It cannot overcome the fundamental bandwidth limitation that makes 500 TB transfer over this link take over a year.
Question 27 — Domain 4: ML Solution Monitoring, Maintenance, and Security
A company runs multiple ML projects on Amazon SageMaker AI, each managed by a different team. The finance department needs to set spending limits per project and receive alerts before budgets are exceeded. How should the ML engineer set this up?
- Create a single AWS Budgets alert at the AWS account level and review it at the end of each quarter
- Create AWS Budgets with separate cost budgets for each SageMaker AI project using cost allocation tags, configure threshold alerts at 50%, 80%, and 100% of the monthly budget, and set up Amazon SNS notifications to the project owners — Correct answer
- Use AWS Cost Explorer to send automatic email alerts whenever any SageMaker AI job exceeds its budget
- Rely on the AWS Free Tier usage alerts to notify teams when SageMaker AI spending increases
Explanation:
- Why B is correct: AWS Budgets allows you to create custom cost budgets filtered by cost allocation tags, enabling per-project budget tracking. Multiple threshold alerts (50%, 80%, 100%) provide early warning before budgets are exceeded. Amazon SNS integration delivers timely notifications to the right stakeholders. This gives granular, proactive cost control per ML project.
- Why A is wrong: A single account-level budget does not provide per-project visibility. Quarterly reviews are too infrequent — by the time costs are reviewed, budgets may already be significantly exceeded. Proactive alerting at multiple thresholds is needed.
- Why C is wrong: AWS Cost Explorer is an analysis and visualization tool for historical and forecasted costs. It does not send automatic budget threshold alerts. AWS Budgets is the service designed for budget alerts and notifications.
- Why D is wrong: AWS Free Tier usage alerts only apply to Free Tier eligible services and usage limits. SageMaker AI training and inference at production scale are not covered by Free Tier alerts. These alerts are unrelated to custom budget management.
Question 28 — Domain 1: Data Preparation
A media company wants to build an automated video analysis pipeline that can identify celebrities, detect inappropriate content, and extract text overlays from uploaded video files. Which TWO Amazon Rekognition capabilities should the ML engineer integrate to address celebrity identification and content moderation? (Select TWO.)
- Amazon Rekognition Celebrity Recognition to identify known individuals in video — Correct answer
- Amazon Rekognition Face Detection to match faces to celebrity databases
- Amazon Textract to extract text overlays from video frames
- Amazon Comprehend to analyze video content for inappropriate material
- Amazon Rekognition Content Moderation to flag inappropriate visual content — Correct answer
- Amazon Transcribe to identify celebrities mentioned in audio
Explanation:
- Why correct (A): Amazon Rekognition Celebrity Recognition can identify thousands of well-known individuals in video frames, returning names, bounding boxes, and confidence scores. This directly addresses the celebrity identification requirement.
- Why correct (E): Amazon Rekognition Content Moderation detects inappropriate, unwanted, or offensive content in images and videos using pre-trained models. It returns moderation labels with confidence scores and taxonomy categories, directly meeting the content moderation need.
- Why B is wrong: Amazon Rekognition Face Detection identifies faces and their attributes (age range, emotions, gender) but does not identify who the person is. Celebrity Recognition is the specific API for identifying known individuals.
- Why C is wrong: Amazon Textract extracts text from documents (forms, tables, printed/handwritten text) but is not designed for extracting text overlays from video frames. While Rekognition DetectText can find text in images/video, Textract is a document-focused service.
- Why D is wrong: Amazon Comprehend is an NLP service that analyzes text for sentiment, entities, and key phrases. It does not process video content directly. It could analyze extracted text downstream but does not perform the video analysis itself.
- Why F is wrong: Amazon Transcribe converts speech to text from audio/video, which is useful for generating subtitles but does not identify celebrities or moderate visual content.
Question 29 — Domain 3: Deployment and Orchestration of ML Workflows
An ML engineering team has a workflow that includes SageMaker training jobs, but also needs to coordinate non-ML steps such as sending SNS notifications, updating a DynamoDB table with metadata, and invoking a Lambda function for custom validation. The team wants a single orchestration service. Which approach best meets these requirements?
- SageMaker Pipelines with Lambda steps for non-ML tasks
- AWS Step Functions with SageMaker and service integrations — Correct answer
- Amazon MWAA with custom Airflow operators for each service
- Amazon EventBridge rules triggering individual Lambda functions
Explanation:
- Why correct (B): AWS Step Functions provides native integrations with over 200 AWS services including SageMaker, SNS, DynamoDB, and Lambda. It is ideal when an ML workflow must coordinate both ML-specific steps and broader AWS service interactions in a single state machine.
- Why A is wrong: SageMaker Pipelines is optimized for ML-specific steps (processing, training, evaluation, registration). It has limited support for orchestrating non-ML services like SNS or DynamoDB directly within the pipeline.
- Why C is wrong: Amazon MWAA can orchestrate these services using Airflow operators, but it introduces significant operational overhead (managing Airflow environments) that is unnecessary when Step Functions provides native service integrations with no infrastructure to manage.
- Why D is wrong: Using EventBridge to trigger separate Lambda functions for each step creates a loosely coupled, event-driven architecture. This makes it difficult to manage workflow state, handle errors, implement retries, and visualize the end-to-end pipeline compared to Step Functions' built-in state management.
Question 30 — Mixed Review (All Domains)
A manufacturing company streams telemetry data from 10,000 IoT sensors at a rate of 5,000 events per second. An ML engineer must compute sliding-window aggregate features (e.g., 5-minute rolling averages and standard deviations) and pass them to a SageMaker real-time endpoint for anomaly detection with sub-second latency. Which architecture meets these requirements?
- Ingest sensor data into Amazon S3 using Kinesis Data Firehose, trigger an AWS Glue ETL job for feature computation, and invoke the SageMaker endpoint via Lambda on job completion
- Ingest sensor data into Amazon Kinesis Data Streams, use an AWS Lambda function to compute features and invoke the SageMaker real-time endpoint directly
- Ingest sensor data into Amazon Kinesis Data Streams, use Amazon Managed Service for Apache Flink to compute sliding-window features, and invoke the SageMaker real-time endpoint via Lambda — Correct answer
- Store sensor data in Amazon DynamoDB Streams, use DynamoDB triggers with Lambda to compute features, and call the SageMaker batch transform job for predictions
Explanation:
- Why correct (C): Amazon Kinesis Data Streams ingests high-throughput streaming data. Amazon Managed Service for Apache Flink natively supports sliding-window aggregations (rolling averages, standard deviations) over time windows with stateful processing, which is essential for computing these features in real time. Lambda then invokes the SageMaker endpoint for low-latency inference.
- Why A is wrong: Kinesis Data Firehose delivers data in micro-batches (minimum 60-second buffer) to S3, and triggering a Glue ETL job adds minutes of latency. This architecture cannot meet sub-second latency requirements.
- Why B is wrong: Lambda functions have a 15-minute maximum execution time and no built-in support for stateful sliding-window aggregations. Computing rolling averages and standard deviations over 5-minute windows requires maintaining state across invocations, which Lambda alone cannot handle efficiently at this throughput.
- Why D is wrong: DynamoDB Streams is not designed for high-throughput sensor ingestion at 5,000 events/second. Additionally, SageMaker batch transform is an offline processing mode that runs on stored datasets, not real-time inference, so it cannot deliver sub-second latency.
JavaScript is required to use this application.
Please enable JavaScript in your browser to access the full NestedCerts platform.
Contact: support@nestedcerts.com