How Do You Require Manual Approval Before SageMaker Model Deployment?
Case Study A company is building a web-based AI application by using Amazon SageMaker. The application will provide the following capabilities and features: ML experimentation, training, a central model registry, model deployment, and model monitoring. The application must ensure secure and isolated use of training data during the ML lifecycle. The training data is stored in Amazon S3. The company must implement a manual approval-based workflow to ensure that only approved models can be deployed to production endpoints. Which solution will meet this requirement?
Community Insight
The exam tests whether you know that the Model Registry's model-version approval status — flipped programmatically via the AWS SDK inside a SageMaker Pipelines step — is the deployment gate, not a tracking, experimentation or monitoring service.
A SageMaker Model Registry approval status gate is how you enforce a manual review before any model version reaches a production endpoint. This page confirms option D and explains why Experiments, Lineage Tracking and Model Monitor cannot authorize deployments.
Many candidates pick ML Lineage Tracking (B) because it lives on the model registry and sounds governance-related, but lineage entities only record ancestry of artifacts — they carry no approval status that blocks a production endpoint.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
SageMaker Model Registry stores each trained model as a model version with an explicit approval status (PendingManualApproval, Approved, Rejected) that deployment pipelines check before pushing to production. Option D combines the two pieces the requirement demands: SageMaker Pipelines orchestrates the ML workflow and can pause or branch on a registration step, and the AWS SDK call UpdateModelPackage flips the version's status to "Approved" after a human reviewer signs off. Because deployment automation only proceeds for Approved versions, the manual gate is enforced by the registry itself rather than by convention. The separate requirement for secure, isolated training data is not what the options are testing — it is satisfied by S3 and network isolation settings outside these choices.Why the Other Options Are Wrong
SageMaker Experiments (A) tracks, organizes and compares runs and trials; it has no concept of an artifact approval that blocks a deployment, so it cannot implement the gate. ML Lineage Tracking (B) captures relationships between datasets, jobs, models and endpoints, but lineage entities are descriptive records — creating a "tracking entity" for approval gives you an audit trail, not an enforceable status. Model Monitor (C) schedules data quality, model quality, bias and feature attribution monitors against live endpoints; it raises alerts about drift, it does not manage release approval, so it is a monitoring control rather than a change-control control. All three confuse observability or traceability with authorization.Community Comment Notes
ninoomfr64 walked through every option and concluded that only the registry route works, noting that the wording of D "tricked me" because it does not spell out the registry step. GiorgioGss anchored the answer in the AWS documentation, quoting that "You can update the approval status of a model version by using the AWS SDK." S_201996 framed it as a pipeline design pattern where a step requires manual approval before the status becomes Approved, and tigrex73 and kashif1220 both stressed that the Model Registry inside the pipeline supports manual or programmatic approval. Ranneh's remark that Model Monitor approves models for deployment captures the classic confusion between monitoring signals and release authority — no monitor can promote a model version.Official Reference
Exam Strategy
When a stem mentions an approval, sign-off or gating step before deployment, map it to the Model Registry approval status and look for the SDK-driven status change inside a pipeline. Services that observe (Model Monitor), record (Lineage Tracking) or compare (Experiments) never authorize a release.
Frequently Asked Questions
Why is SageMaker Model Monitor wrong for approving a model version?
Model Monitor only evaluates data quality, model quality, bias and feature attribution on live traffic. It raises alerts about drift but holds no approval status, so it cannot block or authorize a deployment.
How does SageMaker Pipelines enforce the manual approval step?
The pipeline registers the model version as PendingManualApproval, a reviewer confirms it, and an AWS SDK UpdateModelPackage call sets the status to Approved before the deployment step runs.
Related Analysis
Practice All MLA-C01 Questions
Access 115 questions with complete answers and detailed explanations.
View Full MLA-C01 Practice Test →