How to run SageMaker jobs in an isolated environment without internet access?

AIF-C01 By islever Editorial Last updated Aug 19, 2026

Short answer

B Run SageMaker training and Inference by using network Isolation.

Question

A company needs to use Amazon SageMaker for model training and inference. The company must comply with regulatory requirements to run SageMaker jobs in an isolated environment without internet access. Which solution will meet these requirements?

Run SageMaker training and inference by using SageMaker Experiments.
Run SageMaker training and Inference by using network Isolation. Correct Answer
Encrypt the data at rest by using encryption for SageMaker geospatial capabilities.
Associate appropriate AWS Identity and Access Management (IAM) roles with the SageMaker jobs.

Key Takeaways

The question tests knowledge of SageMaker's built-in security features for data privacy; the trap is confusing general security measures like IAM or encryption with the specific network-level isolation required for air-gapped-like environments.

Network Isolation is the specific Amazon SageMaker feature designed to restrict training and inference jobs from accessing the internet, ensuring compliance with strict regulatory requirements. The community consensus confirms that enabling this option creates a fully isolated container environment.

Common mistake: Candidates often select IAM roles (Option D) because they are essential for access control, but IAM does not prevent network egress or provide the isolated compute environment required by the prompt.

Expert Analysis

Why the Answer Is Correct

Network Isolation is a core capability of Amazon SageMaker that runs training and inference jobs in containers without outbound internet access. This ensures that model artifacts and training data do not leave the secure boundary, satisfying regulatory mandates for isolated processing environments.

Why the Other Options Are Wrong

SageMaker Experiments (Option A) are for tracking ML workflow iterations, not network security. Encryption at rest (Option C) protects data storage but does not restrict network connectivity during job execution. IAM roles (Option D) manage permissions to start jobs but cannot enforce network isolation policies on the underlying containers.

Community Comment Notes

Comments [1], [2], and [4] unanimously support Option B, highlighting that Network Isolation explicitly disables outbound internet access and restricts resources to specified VPCs. Comment [2] provides a clear explanation of how this feature meets regulatory standards by preventing external network access.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Moon 👍 1 Answered B

B: Run SageMaker training and inference by using network isolation. Explanation: Network isolation in Amazon SageMaker ensures that training and inference jobs run in a fully isolated environment without internet access. When network isolation is enabled: SageMaker jobs can only access resources within the specified Virtual Private Cloud (VPC). Outbound internet access is disabled. Data and models remain secure and compliant with regulatory requirements.
aws_Tamilan 👍 1 Answered B

B. Run SageMaker training and inference by using network isolation. Explanation: Network isolation is a feature in Amazon SageMaker that ensures that your training and inference jobs are run in a secure, isolated environment without internet access. This is a critical requirement for complying with regulatory standards that mandate the use of isolated environments for sensitive operations.
Jessiii 👍 1 Answered B

Network isolation allows Amazon SageMaker jobs (including training and inference) to run in a private, isolated environment without internet access, which is often required for compliance with regulatory requirements. This ensures that the SageMaker jobs do not have access to external networks, enhancing data security and privacy.
may2021_r 👍 1 Answered B

The correct answer is B. Network isolation allows SageMaker to run without internet access, meeting regulatory requirements.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All AIF-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AIF-C01 Practice Test →

← Back to AIF-C01 Study Guide