Q: 14

Scenario: An administrator must ensure that each AI developer can access only their assigned SageMaker notebook instance while maintaining shared access to Amazon Rekognition APIs and training data stored in Amazon S3. Question- Which solution will meet this requirement?. Options:

Options

Discussion

Ravi M. Oct 8, 2026 9:10 am

Option A

Piya O. Oct 7, 2026 3:34 pm

A. since IAM policies can lock down SageMaker permissions by notebook ARN for each user. B is a trap here, because JupyterLab roles don't cover AWS-level access controls. Pretty sure A is best, but open to counterpoints.

Sam Oct 2, 2026 2:31 pm

I thought D might work since lifecycle configs can block some access at notebook start. Maybe not as tight as IAM policies, but it can help restrict what happens on unassigned notebooks. Anyone else choose D for scenarios like this?

Maya O. Sep 21, 2026 5:28 am

Saw something like this in a practice test, it's D. When Clarify says there's significant skew, it's almost always class imbalance causing poor minority class detection.

LukeH Oct 5, 2026 11:17 am

AWS always asks this kind of class imbalance! D

Arjun Oct 7, 2026 3:18 pm

A is the way to go here since IAM lets you lock down SageMaker by notebook ARN per user, which covers the isolation part. Pretty sure that's what AWS expects because it follows least privilege. Could see confusion with D but think A matches exam intent, agree?

Priya Sep 25, 2026 4:09 pm

C blocks network but not actual notebook instance access, so that's a common trap. I don’t think B solves this because JupyterLab roles don’t enforce AWS resource limits. A fits best since IAM restricts by notebook ARN for each dev. Open if someone thinks D is better, but pretty sure A is what AWS exams want.

Nina Sep 21, 2026 3:36 pm

A , matches what the official AWS guide and practice questions focus on for least privilege. If you want to double check, try the official documentation or exam labs for IAM + SageMaker restrictions.

Emma C. Oct 3, 2026 4:27 pm

A that's the IAM way. Least privilege per user is what AWS expects for this kind of control.

Sam Q. Oct 8, 2026 4:20 pm

Had something like this in a mock, it's A. Specific IAM policies per developer let you lock access to only their notebook instance and still give shared Rekognition/S3 rights. Anyone else pick A here?

Be respectful. No spam.

Correct Answer:

Explanation

The most effective and secure method to meet this requirement is by leveraging AWS Identity and Access Management (IAM). By creating a specific IAM policy for each developer's IAM user, an administrator can grant permissions to SageMaker actions (like StartNotebookInstance, StopNotebookInstance, CreatePresignedNotebookInstanceUrl) while restricting these actions to a specific resource. The resource is identified by its unique Amazon Resource Name (ARN). This enforces the principle of least privilege, ensuring developers can only access and manage the notebook instance explicitly assigned to them, while shared policies can still grant them access to common resources like Amazon Rekognition and S3.

Why Incorrect

B: A shared notebook instance contradicts the requirement for each developer to have their own assigned instance and introduces risks of interference and data exposure between developers.

C: Port forwarding is a network configuration tool and is not a suitable or standard mechanism for managing user-level access control to AWS resources like SageMaker notebooks.

D: SageMaker lifecycle configurations are shell scripts used to automate customization of a notebook environment (e.g., installing libraries) upon creation or start. They are not an access control mechanism.

References

1. AWS SageMaker Developer Guide - Identity-Based Policy Examples: This official documentation provides explicit examples of IAM policies that restrict access to a specific notebook instance by specifying its ARN in the Resource element of the policy statement. This directly validates the approach described in option A.

Reference: AWS SageMaker Developer Guide, section "Amazon SageMaker Identity-Based Policy Examples," subsection "Restrict access to a specific notebook instance."

2. AWS IAM User Guide - Policies and permissions: This guide explains how IAM policies work, including the use of ARNs to specify resources. It states, "For many services, you can restrict the actions that a user can perform by specifying the ARN of the resource..." This foundational principle supports option A.

Reference: AWS IAM User Guide, section "Policies and permissions in IAM," subsection "Controlling access to resources."

3. AWS SageMaker Developer Guide - Customize a Notebook Instance Using a Lifecycle Configuration Script: This document clarifies the purpose of lifecycle configurations as automation scripts for setup and customization, not for enforcing security or access control policies. This confirms why option D is incorrect.

Reference: AWS SageMaker Developer Guide, section "Customize a Notebook Instance Using a Lifecycle Configuration Script."

Scenario: An administrator must ensure that each AI developer can access only their assigned SageMaker notebook instance while maintaining shared access to Amazon Rekognition APIs and training data stored in Amazon S3. Question- Which solution will meet this requirement?. Options:

Premium Access Includes