Skip to content

Skill 1.1.1: Extract data from data sources

Question 1 - S3 Storage Classes for AI/ML Training Data

A financial services company is building an ML model for fraud detection. The data science team has accumulated 15 TB of historical transaction data in Amazon S3. The dataset will be used for a one-time model training run next month, after which it will be archived for regulatory compliance (7-year retention). The team needs to minimize storage costs while ensuring the data can be accessed immediately when training begins.

Which S3 storage class transition strategy BEST satisfies these requirements? (Choose ONE)

  • A) Store the data in S3 Standard, and after training, transition to S3 Glacier Deep Archive.
  • B) Store the data in S3 Intelligent-Tiering, and after training, transition to S3 One Zone-IA.
  • C) Store the data in S3 Standard-Infrequent Access (S3 Standard-IA), and after training, transition to S3 Glacier Deep Archive.
  • D) Store the data in S3 One Zone-IA, and after training, transition to S3 Glacier Flexible Retrieval.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: S3 Standard-IA is designed for data accessed less frequently but requires rapid access when needed. It provides immediate access to training data at a lower storage cost than S3 Standard. After training, transitioning to Glacier Deep Archive provides the lowest-cost storage for long-term archival with 7-year retention compliance, accepting delayed retrieval (12-48 hours) which is acceptable since the data is no longer needed for immediate access.

Distractor Analysis

  • A is Incorrect: S3 Standard has the highest ongoing storage cost among the options and is unnecessarily expensive for data that will be accessed only once. The transition to Deep Archive is correct, but the initial storage class is suboptimal for cost.
  • B is Incorrect: S3 Intelligent-Tiering automatically moves data between access tiers based on changing access patterns, which adds monitoring overhead and minimum storage duration charges. S3 One Zone-IA after training lacks the regulatory durability guarantee needed for 7-year compliance retention (data is lost if the single Availability Zone fails).
  • D is Incorrect: S3 One Zone-IA stores data in a single Availability Zone, which violates the regulatory compliance requirement for durable archival. Glacier Flexible Retrieval is more expensive than Glacier Deep Archive for data that will rarely (if ever) be accessed during the 7-year retention period.

Key Takeaway: Match S3 storage classes to access frequency: S3 Standard-IA for infrequent but immediate-access needs, and S3 Glacier Deep Archive for long-term archival where retrieval time is non-critical.

Question 2 - Streaming Ingestion with Kinesis and Feature Processing

An e-commerce company is building a real-time product recommendation system. User clickstream events are ingested through Amazon Kinesis Data Streams with 25 shards. A consumer application built with Amazon Managed Service for Apache Flink processes these events, enriches them with user metadata from Amazon DynamoDB, and writes the enriched features to Amazon SageMaker Feature Store for online inference.

The operations team notices that the consumer application is falling behind the incoming record rate, and the DynamoDB table used for enrichment is consistently throttling read requests. The team needs to resolve this bottleneck with minimal operational overhead.

Which solution should the team implement? (Choose ONE)

  • A) Increase the number of Kinesis shards from 25 to 50 to distribute the load more evenly.
  • B) Deploy additional Flink consumer instances to increase processing parallelism.
  • C) Enable DynamoDB Auto Scaling and increase the read capacity units (RCUs) on the DynamoDB table.
  • D) Switch from Kinesis Data Streams to Amazon MSK to improve ingestion throughput.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: DynamoDB throttling occurs when the read capacity (RCUs) is insufficient for the incoming traffic. Enabling DynamoDB Auto Scaling allows the table to automatically adjust its provisioned capacity based on utilization, resolving throttling with minimal manual intervention. Alternatively, if the table is in on-demand mode, the throttling may indicate a burst-specific issue, but the question specifies throttling, which points to capacity limits. Since DynamoDB is the stated bottleneck, scaling its capacity directly addresses the upstream backpressure.

Distractor Analysis

  • A is Incorrect: Increasing Kinesis shards from 25 to 50 may improve overall stream capacity, but DynamoDB is already throttling. Adding more shards means more records flow into the consumer, which then hits the same DynamoDB throttle even harder. This would exacerbate the problem.
  • B is Incorrect: Adding more Flink consumer instances increases processing parallelism, but if DynamoDB is the bottleneck (throttling), additional consumers will simply send more concurrent read requests and get throttled even more. This moves the queue but does not resolve the root cause.
  • D is Incorrect: Switching from Kinesis to Amazon MSK involves significant redesign (Kafka topics, consumer groups, connector setup), adding unnecessary complexity. The underlying bottleneck is DynamoDB throttling, not the stream ingestion mechanism itself.

Key Takeaway: In streaming pipelines, identify the true bottleneck (often downstream write targets like DynamoDB, RDS, or OpenSearch) before scaling consumer or stream resources—adding capacity upstream only shifts the queue if the downstream constraint remains.

Question 3 - Columnar vs Row-Oriented Data Format for Analytics

A healthcare analytics company stores patient monitoring data in Amazon S3 for ML model training. The data includes 40 columns (e.g., heart rate, blood pressure, temperature, patient ID, timestamps, medication codes). The data science team frequently runs queries that analyze only 5 of these columns across millions of patient records using Amazon Athena.

However, each query currently scans the entire dataset, resulting in high costs and slow query performance. The team needs to optimize query performance and minimize data scanned.

Which data format change BEST addresses the requirement? (Choose ONE)

  • A) Convert the dataset from CSV to one JSON document per patient record.
  • B) Compress the existing CSV files using GZIP compression in S3.
  • C) Convert the dataset to Apache Parquet with Snappy compression.
  • D) Partition the existing CSV files by patient ID using S3 prefixes.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: Parquet is a columnar storage format that enables column pruning—Athena reads only the specific columns referenced in the query, skipping the other 35 columns entirely. Snappy compression reduces file size further and is optimized for Parquet. This combination significantly reduces data scanned per query, which directly lowers Athena costs and improves performance.

Distractor Analysis

  • A is Incorrect: JSON is a row-oriented format. Converting CSV to JSON does not change the fundamental issue: Athena still needs to parse entire records to extract even a subset of columns, so the data scanned remains roughly the same.
  • B is Incorrect: GZIP compression on CSV files reduces storage size and slightly reduces data scanned (due to compression), but Athena still needs to decompress and parse the entire file including all columns. Compression does not provide column pruning benefits.
  • D is Incorrect: Partitioning by patient ID is useful for filtering by specific patients, but the workload described analyzes millions of patient records (i.e., broad-brush analytics across almost all patients), not narrow subsets. Partitioning does not reduce the number of columns scanned since CSV still requires full parsing per record.

Key Takeaway: For analytic workloads that query a subset of columns across many rows, columnar formats (Parquet, ORC) provide column pruning that dramatically reduces data scanned and query cost compared to row-oriented formats (CSV, JSON) regardless of compression or partitioning.

Question 4 - Shared File System for Distributed Model Training

A machine learning engineering team is deploying a distributed deep learning training job using Amazon SageMaker with 8 ml.p4d.24xlarge instances. The training script uses PyTorch Distributed Data Parallel (DDP) and requires all instances to simultaneously read from and write to a shared dataset of high-resolution medical imaging files (total 2 TB).

The team needs a shared file system that provides concurrent access from all instances, high throughput, and minimal operational overhead.

Which storage solution should the team use? (Choose ONE)

  • A) Amazon Elastic Block Store (Amazon EBS) volumes attached to each instance with rsync for data synchronization.
  • B) Amazon Elastic File System (Amazon EFS) mounted to all instances.
  • C) Amazon FSx for Lustre mounted to all instances.
  • D) Amazon S3 buckets accessed directly through the SageMaker training container.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: Amazon FSx for Lustre provides a high-performance, POSIX-compliant file system built specifically for high-performance computing (HPC) and ML training workloads. It offers sub-millisecond latencies, millions of IOPS, and hundreds of GB/s of throughput, making it ideal for distributed training where all instances need concurrent read/write access to shared data. FSx for Lustre is fully managed, minimizing operational overhead, and can optionally synchronize with data stored in S3.

Distractor Analysis

  • A is Incorrect: EBS volumes can only be attached to a single instance at a time within the same Availability Zone. Using rsync for synchronization creates data duplication across 8 instances, introduces consistency problems, and does not provide a shared namespace.
  • B is Incorrect: Amazon EFS provides shared file access, but it is designed for general-purpose workloads with standard NFS semantics. For high-performance distributed training on 8 p4d instances requiring massive throughput and low latency, EFS's throughput limits may become a bottleneck compared to FSx for Lustre. While EFS now includes Max I/O performance mode, it still may not match Lustre for this specific HPC workload, especially for 2 TB of high-resolution imaging data being written concurrently.
  • D is Incorrect: S3 is object storage, not a file system. While SageMaker training jobs can access S3 data via s3:// paths and data channels, there is no POSIX-compliant shared file namespace. Training scripts requiring simultaneous read/write operations on the same files with concurrent modification would not work efficiently with S3's eventual consistency model.

Key Takeaway: For distributed training requiring shared, high-throughput, low-latency file access across multiple compute instances, FSx for Lustre is the AWS-designed solution—it bridges S3's durability with HPC-grade file semantics.

Question 5 - Vector Database Selection for RAG Application

A legal technology startup is building a retrieval-augmented generation (RAG) application using Amazon Bedrock. The application will store approximately 50 million document embeddings. The team has the following requirements:

  • Similarity search must return results in under 100 ms.
  • The embeddings must be stored alongside their associated document metadata for filtered search.
  • The team wants to minimize operational overhead and avoid managing infrastructure.
  • The solution must support automatic scaling for spiky workload patterns.

Which storage solution BEST meets these requirements? (Choose ONE)

  • A) Amazon DynamoDB with a secondary index on the embedding vectors.
  • B) Amazon RDS for PostgreSQL with the pgvector extension deployed as a Multi-AZ instance.
  • C) Amazon OpenSearch Serverless with a vector collection using the k-NN algorithm.
  • D) Amazon S3 storing embeddings as Parquet files, queried through Amazon Athena.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

  • C is Correct: Amazon OpenSearch Serverless provides vector search capabilities via the k-NN (k-nearest neighbor) plugin, handling both embeddings and metadata in a single index for filtered search. The Serverless option automatically scales compute and storage based on demand, eliminating infrastructure management. OpenSearch Serverless also provides response times under 100 ms for vector queries, even at the 50M vector scale, provided proper RAM and index settings are configured.

Distractor Analysis

  • A is Incorrect: DynamoDB is a key-value/document database designed for fast lookups by primary key or secondary index. It does not natively support vector similarity search (k-NN, cosine similarity, etc.). You would need to implement custom algorithmic workarounds (like locality-sensitive hashing), which violates the "minimize operational overhead" constraint.
  • B is Incorrect: pgvector in Amazon RDS for PostgreSQL supports vector similarity search, but it requires setting up, managing, and scaling the RDS instance. Multi-AZ deployment adds high availability but does not address dynamic scaling for spiky workloads. A single RDS instance may struggle with 50M vectors and sub-100ms queries at scale, and managing RDS violates the minimal operational overhead requirement.
  • D is Incorrect: S3 is object storage without native vector search capabilities. Athena provides SQL querying over S3 data but does not support efficient k-NN retrieval. Performing similarity search over 50M embeddings with Athena would require full table scans, resulting in extremely slow queries that exceed the 100ms requirement.

Key Takeaway: For RAG applications requiring fast, scalable vector similarity search with metadata filtering, Amazon OpenSearch Serverless is the AWS-native solution; S3 and DynamoDB lack native k-NN capabilities, and RDS/pgvector requires more operational management for large-scale workloads.

Question 6 - SageMaker Feature Store Online vs Offline

A ride-sharing company has built an ML model to predict rider demand. The model uses features including rider's current location, trip history frequency, and time-based features. During model training, the team uses Amazon SageMaker Feature Store successfully. However, when deploying the model for real-time inference, the team notices significant latency when looking up "today's_trip_count" for each rider.

Investigation reveals that the inference code queries the offline store to retrieve features, and each query takes several seconds. The team needs to resolve this issue by configuring feature ingestion correctly for online inference. The model needs feature lookups to complete in under 100 milliseconds.

Which configuration should the team implement? (Choose ONE)

  • A) Increase the read capacity of the offline store's underlying Glue Data Catalog tables.
  • B) Enable the online store feature when creating the Feature Group, and ingest features with both Online and Offline storage modes.
  • C) Cache the offline store queries using ElastiCache for Redis to reduce lookup time.
  • D) Modify the inference code to pre-compute features and store them as environment variables.
Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: When creating a Feature Group in SageMaker Feature Store, you can configure both an online store (low-latency, high-throughput, built on a highly available infrastructure) and an offline store (Parquet files in S3 for batch/historical access). The online store provides millisecond-latency lookups by record identifier, which is essential for real-time inference. Ingesting features with StorageType.Online (or both Online and Offline) makes them immediately available for low-latency retrieval via GetRecord.

Distractor Analysis

  • A is Incorrect: The offline store is designed for batch/historical access via Athena, EMR, or SageMaker training jobs. Increasing read capacity on Glue/Athena tables does not convert offline storage into a low-latency online store capable of sub-100ms lookups.
  • C is Incorrect: Adding an ElastiCache caching layer introduces additional infrastructure management, cost, and complexity. It also does not solve the fundamental mismatch: features should be ingested into the online store natively, not cached from slow offline queries.
  • D is Incorrect: Pre-computing features as environment variables is not feasible for dynamic features like a rider's trip history count which changes frequently and requires real-time lookups per inference request. This approach also doesn't scale and would cause stale features.

Key Takeaway: SageMaker Feature Store separates online (low-latency, millisecond lookups) and offline (historical, batch access) stores—ensure features are ingested with StorageType.Online when serving real-time inference demands.

Question 7 - Hybrid Storage Architecture for Model Training with Multiple Sources

A manufacturing company collects IoT sensor data from production lines. The data exists in three systems:

  • 500 GB of structured sensor readings in Amazon RDS for PostgreSQL
  • 5 TB of unstructured JSON logs in Amazon S3
  • Real-time telemetry from factory floor devices through Amazon Kinesis Data Streams

The data science team needs to create a unified training dataset for a predictive maintenance model. The pipeline must join sensor readings from RDS with JSON logs from S3 and the streaming data. The company requires the pipeline to be serverless, maintainable, and orchestrated through a visual workflow.

Which solution BEST satisfies these requirements? (Choose ONE)

  • A) Use AWS Glue crawlers to catalog RDS and S3 data, then use AWS Glue Studio to build ETL jobs that join data from all three sources (RDS via JDBC, S3 via data catalog, Kinesis via Glue streaming ETL), orchestrated with AWS Step Functions.

  • B) Use Amazon EMR cluster with Apache Spark to read from RDS (via JDBC), S3 (via Hadoop FileSystem API), and Kinesis (via Spark Streaming connector), orchestrated with Apache Airflow on EC2.

  • C) Use Amazon EC2 instances with custom Python scripts using pandas to read from RDS, S3, and Kinesis, orchestrated with cron jobs.

  • D) Use AWS Glue crawlers to catalog RDS and S3 data, then use Amazon QuickSight to combine data into a single dataset.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: AWS Glue is a serverless data integration service. Glue crawlers can automatically discover schemas from RDS (via JDBC connection) and S3 (via mapping), creating tables in the Glue Data Catalog. Glue Studio provides a visual, no-code/low-code interface for building ETL jobs. Glue supports reading from multiple sources including RDS tables, S3 (via the Data Catalog), and Kinesis Data Streams (via the streaming ETL feature). AWS Step Functions provides a serverless orchestration layer to chain these jobs into a workflow. This solution meets all constraints: serverless, maintainable, visual workflow connection.

Distractor Analysis

  • B is Incorrect: While Amazon EMR can technically handle this workload, it requires managing the EMR cluster (provisioning, scaling, node types, etc.). Apache Airflow on EC2 adds additional operational overhead (installing, configuring, maintaining the Airflow server). This violates the "serverless" and "minimal operational overhead" constraints.
  • C is Incorrect: Custom Python scripts on EC2 with pandas require manual management of EC2 instances, dependencies, scaling, and fault tolerance. The orchestration via cron jobs is brittle and not visual. This approach has the highest operational overhead and violates maintainability.
  • D is Incorrect: Amazon QuickSight is an analytics and visualization service, not a data integration tool. It cannot perform ETL jobs or designed for merging data into training datasets. It's for creating dashboards and visualizations.

Key Takeaway: For serverless data integration and merging from multiple sources (RDS, S3, Kinesis) use AWS Glue (Studio for visual ETL) orchestrated by Step Functions—this eliminates cluster management and provides a maintainable workflow.

Question 8 - S3 Access Patterns for Image and Audio Data

A computer vision startup is building an image classification model for detecting manufacturing defects. The team has collected:

  • 10 million images (average 500 KB each) in Amazon S3 (Standard tier)
  • Associated metadata (labels, camera IDs, timestamps) in a JSON file per image

The team is training a model using Amazon SageMaker. During training, they need to efficiently read images and their associated metadata for each batch. The current approach loads all images into memory at once, causing out-of-memory errors on the training instances.

Which architecture change BEST optimizes the data access pattern for training? (Choose ONE)

  • A) Store all images as Base64-encoded strings inside a single JSON manifest file.

  • B) Use SageMaker Pipe Mode with a manifest file containing S3 object keys, allowing the training job to stream data directly without loading all objects into memory at once.

  • C) Convert all images to a single TFRecord file and store it in S3.

  • D) Store images in Amazon DynamoDB for faster random access during training.

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: SageMaker Pipe Mode streams data directly from S3 to the training instance in a memory-efficient manner. Instead of downloading all objects, the training job reads data in chunks as needed by the model augmentation pipeline. A manifest file (JSON Lines format) lists all S3 object URIs and their metadata, providing an efficient way to identify and stream relevant objects. This approach avoids loading all 10M images (5 TB total) into memory simultaneously and supports efficient batched reading.

Distractor Analysis

  • A is Incorrect: Base64-encoding images into a single JSON manifest would create an enormous file (increasing size by ~33% due to Base64 overhead) and would still require loading the entire manifest into memory for parsing. This approach does not solve the out-of-memory issue.
  • C is Incorrect: TFRecord is a valid format for TensorFlow training pipelines, but it is TensorFlow-specific and requires preprocessing to create the TFRecord file. It does not fundamentally solve the memory issue if the training code still loads the entire TFRecord into memory. Pipe Mode offers a more general solution that works with multiple frameworks (including PyTorch via SageMaker Data Parallel).
  • D is Incorrect: DynamoDB is not designed for storing large binary objects like images. The maximum item size in DynamoDB is 400 KB, which is smaller than the average image (500 KB). DynamoDB also has significantly higher storage costs compared to S3 for this volume of data.

Key Takeaway: For large-scale image/audio training in SageMaker, use Pipe Mode with manifest files to stream data from S3 incrementally—avoiding out-of-memory errors and enabling training to start before all data is downloaded.

Question 9 - Kinesis Data Streams Capacity and Resharding

A media streaming company is building a real-time content moderation system. User-generated video metadata (VideoID, UserID, Title, UploadTime, Tags) is ingested into Amazon Kinesis Data Streams. The stream currently has 10 shards. Each record is approximately 2 KB in size.

The company expects traffic to grow from 10,000 records/second to 25,000 records/second during a major holiday event next month. The data analytics team needs to ensure the stream can handle this increased load.

What actions should the team take? (Choose TWO)

  • A) Increase the number of Kinesis Data Streams shards to at least 25.

  • B) Use the Kinesis Resharding API (UpdateShardCount) to adjust capacity based on projected throughput.

  • C) Implement batch processing (write multiple records per PutRecord call) in the producer.

  • D) Enable Kinesis Enhanced Fan-Out for all consumer applications.

  • E) Decrease the record size from 2 KB to 1.5 KB by removing optional metadata fields.

Click to reveal Answer & Explanation

Correct Answer: A and B

Correct Options Analysis

  • A is Correct: Each Kinesis Data Streams shard provides 1 MB/second or 1000 records/second of write capacity. With 10 shards, the stream supports 10,000 records/second or 10 MB/second. To handle 25,000 records/second, the team needs at least 25 shards (25 × 1,000 records/sec = 25,000 records/sec). Since 2 KB per record × 25,000 = 50 MB/second, that exceeds the 25 MB/second limit of 25 shards (25 × 1 MB/sec = 25 MB/sec), so more shards may actually be needed for the throughput bound—but let's verify: 50 MB/s across 25 shards means each shard handles 2 MB/s, which exceeds the 1 MB/s limit. The team needs 50 MB/s ÷ 1 MB/s per shard = at least 50 shards, or they need to ensure the record rate fits both constraints. The minimum of 25 shards addresses the record count constraint, but the overall throughput constraint requires more shards. Since the question asks about record rate specifically, 25 shards is the minimum starting point. The question's math indicates 25 shards is the answer targeting the record-based limit.
  • B is Correct: The UpdateShardCount API (or Console operation) enables resharding of Kinesis Data Streams to adjust capacity dynamically without needing to recreate the stream. This is the appropriate operational mechanism to scale shard count based on projected load.

Distractor Analysis

  • C is Incorrect: Batch processing (PutRecords) improves producer efficiency but does not change the fundamental per-shard limits. The throughput limit still applies whether records arrive singly or in batches. Batch processing doesn't allow exceeding the shard's 1 MB/sec or 1000 records/sec limits.
  • D is Incorrect: Enhanced Fan-Out (EFO) improves consumer-side throughput by enabling dedicated 2 MB/second per consumer per shard. This does not help with producer-side capacity. The constraint described is on write throughput, not consumer reads.
  • E is Incorrect: Reducing record size from 2 KB to 1.5 KB decreases overall throughput requirements (25,000 records/sec × 1.5 KB = 37.5 MB/sec vs 50 MB/sec), but it still requires more shards than the existing 10. This is also a workaround that sacrifices data completeness, which may not be acceptable for content moderation.

Key Takeaway: Kinesis shard capacity is bounded by both record rate (1000 records/sec) and data rate (1 MB/sec) per shard; use UpdateShardCount to scale shards based on projected peak loads, and remember that producer batching does not increase shard capacity limits.

Question 10 - Compliance and Data Encryption for ML Training Data

A pharmaceutical company is building ML models for drug discovery. The training data includes clinical trial results, patient genomic data, and molecular structures. Compliance regulations (HIPAA, GDPR) mandate:

  • All data at rest must be encrypted with a customer-managed key (CMK) in AWS KMS.
  • All data in transit must be encrypted.
  • Access to training data must be restricted to only the SageMaker training job's IAM role.
  • The solution must minimize operational overhead.

The team stores training data in Amazon S3. Which set of configurations satisfies all compliance requirements? (Choose TWO)

  • A) Enable S3 server-side encryption with S3-Managed Keys (SSE-S3) on the training bucket.

  • B) Enable S3 server-side encryption with KMS keys (SSE-KMS) using a customer-managed key (CMK) in AWS KMS, ensuring the SageMaker role has the necessary KMS permissions.

  • C) Configure the S3 bucket policy to grant access only to the SageMaker training job's IAM role using aws:PrincipalArn condition.

  • D) Enable Amazon Macie on the S3 bucket to automatically encrypt existing unencrypted objects.

  • E) Allow public access to the S3 bucket but restrict object-level access through each object's ACL.

Click to reveal Answer & Explanation

Correct Answer: B and C

Correct Options Analysis

  • B is Correct: SSE-KMS with a customer-managed key (CMK) ensures that the encryption keys are controlled by the customer in AWS KMS. The CMK provides audit logs, access control, and compliance alignment. The SageMaker execution role needs kms:Decrypt and kms:GenerateDataKey permissions to read and write data to the bucket. This satisfies "all data at rest must be encrypted with a customer-managed key."
  • C is Correct: A bucket policy with aws:PrincipalArn condition allows the organization to restrict access solely to the SageMaker training job's IAM role. Combined with s3:GetObject permissions and implicit denial of access for other principals, this ensures only the SageMaker job can read the training data.

Distractor Analysis

  • A is Incorrect: SSE-S3 uses Amazon-managed keys, not customer-managed keys (CMKs). HIPAA/GDPR compliance in this scenario specifically requires CMKs for regulatory control, key rotation, and access auditing. SSE-S3 doesn't provide the customer-controlled key management required.
  • D is Incorrect: Amazon Macie is a data classification and discovery service that identifies sensitive data (PII, PHI) in S3 buckets. It does not automatically encrypt data or enforce encryption. It can alert on unencrypted objects but does not remediate them.
  • E is Incorrect: Public access, even with object-level ACLs, is not a secure or compliant pattern for sensitive patient data. ACLs are legacy and limited compared to bucket policies and IAM policies. This fails the "restrict access to only the SageMaker role" requirement and violates HIPAA/GDPR best practices.

Key Takeaway: For regulated ML workloads (HIPAA/GDPR), combine SSE-KMS with customer-managed keys for at-rest encryption and bucket policies with aws:PrincipalArn conditions to enforce least-privilege access—SSE-S3 and Macie do not provide equivalent control or automatic remediation.