Question

A healthcare company trains models on de-identified patient records using a custom container stored in Amazon ECR. Compliance requires that the training job must not be able to make any outbound network calls to the internet or any external endpoint, even though the container code has network-capable dependencies. The training data and container are already inside the company's AWS account. Which SageMaker configuration best enforces this requirement?

Accepted Answer

Enable network isolation on the training job so the container has no inbound or outbound network access.

Answer

Launch the training job in a private VPC subnet with a NAT gateway to control outbound traffic.

Answer

Attach a security group that allows only HTTPS egress to approved AWS service endpoints.

Answer

Encrypt the training data and container images with a customer-managed KMS key.