Task 3.2: Provision and configure resources for ML and AI workloads based on existing architecture and requirements.

• AMove the model to serverless inference so it scales to zero automatically

  Incorrect

  Serverless inference does scale to zero, but it does not support GPUs, which this model needs.

• BSet the variant minimum capacity to 0 in a target tracking policy on InvocationsPerInstance

  Incorrect

  Scaling to zero is tied to inference components; a variant without them cannot scale in to zero instances. Once at zero, a scale-out also needs a step scaling policy and alarm.

• CDeploy it as an inference component with min 0 instances and step scaling

  Correct

  An endpoint can scale in to and out from zero instances only if it hosts inference components, with MinInstanceCount set to 0. A step scaling policy tied to an alarm provisions an instance again when requests arrive.

• DConvert the endpoint to asynchronous inference

  Incorrect

  Asynchronous inference can scale to zero, but callers must place payloads in S3 and use asynchronous invocation, which changes the real-time interface the team wants to keep.

Real-time endpoints can scale to zero when models are deployed as inference components. Expect errors during the several minutes it takes to provision the first instance again.

• AInvocationsPerInstance with a lower target value

  Incorrect

  A lower target scales out earlier, but the metric still counts invocations per minute, not how many long-running requests are in flight, and it is reported less often.

• BCPUUtilization as a custom metric

  Incorrect

  On a GPU-bound generation model, CPU usage says little about how many requests are waiting.

• CModelLatency, with a scheduled scaling action each morning

  Incorrect

  A fixed schedule cannot follow unpredictable spikes, and latency rises only after requests are already queuing.

• DConcurrentRequestsPerModel

  Correct

  This high-resolution metric counts the simultaneous requests a model container is handling, including queued ones, and for streaming responses it tracks each request until the last token. It emits data more often than standard metrics, so scaling reacts faster.

For long or streaming requests, concurrency is a better measure of load than invocation counts. The high-resolution concurrency metrics also let auto scaling react sooner.

• ASet VpcConfig with private subnets in two Availability Zones and security groups

  Correct

  VpcConfig makes SageMaker AI attach network interfaces in your subnets, giving the container a network connection inside the VPC that is not connected to the internet. At least two subnets in different Availability Zones are required.

• BEnable network isolation on the model

  Incorrect

  With network isolation the container cannot make any outbound network calls, including to S3, so it could not read the files or query the database.

• CAdd a route from the private subnets to an internet gateway

  Incorrect

  An internet route breaks the security rule. Private connectivity to S3 and RDS does not need the internet.

• DCreate an S3 VPC endpoint so the container reaches the bucket privately

  Correct

  With no internet route, the container needs a VPC endpoint to reach S3. The hosting guide lists creating an S3 VPC endpoint, optionally with a restrictive endpoint policy.

• ECreate an interface VPC endpoint for the SageMaker AI API and Runtime

  Incorrect

  An interface endpoint for the SageMaker AI API keeps API calls such as invoking the endpoint private. It does not give the container access to S3 objects.

VPC-attached endpoints reach private resources through the subnets and security groups you choose, and reach AWS services such as S3 through VPC endpoints. Network isolation is a different control that blocks outbound calls entirely.

• AThe Instances compute type for AgentCore Runtime

  Correct

  Instances run agents on AWS managed EC2 infrastructure in your account and support persistent, multi-day sessions of up to 14 days and GPU-accelerated workloads.

• BThe microVM compute type, with a longer session timeout

  Incorrect

  MicroVM sessions are serverless and start instantly, but they run for up to 8 hours, not several days.

• CAgentCore Memory to keep the session running

  Incorrect

  Memory stores short-term and long-term context for agents. It does not change how long a runtime session can run or add a GPU.

• DAn AWS Lambda function with the maximum timeout

  Incorrect

  A Lambda function can run for at most 900 seconds (15 minutes), far short of a session that lasts several days.

AgentCore Runtime offers two compute types: microVMs for serverless, isolated sessions of up to 8 hours, and Instances for long sessions of up to 14 days and GPU workloads.

• AFiles written to the runtime session's local filesystem

  Incorrect

  Each session runs in its own microVM that is terminated, with memory sanitized, when the session ends, so nothing would remain for the next conversation.

• BA larger context window on the foundation model

  Incorrect

  A larger window holds more of the current conversation, but it does not carry anything over to a conversation weeks later.

• CAgentCore Observability traces of past sessions

  Incorrect

  Observability records traces, metrics and logs for debugging and monitoring. It is not a store the agent reads preferences from.

• DAgentCore Memory, with short-term and long-term memory

  Correct

  AgentCore Memory is a managed service with short-term memory for turn-by-turn context in a session and long-term memory that extracts and keeps insights such as user preferences across sessions.

Agents are stateless by default. AgentCore Memory adds managed state at two levels: within a session and across sessions.

• AA SageMaker training plan for those dates

  Correct

  Training plans reserve GPU capacity as Reserved Capacity blocks defined by instance type, quantity, Availability Zone, duration and start and end times, giving predictable access within your timelines.

• BManaged spot training with checkpoints enabled

  Incorrect

  Spot instances can be interrupted and jobs can wait for Spot capacity, so spot training does not secure capacity for set dates.

• CA SageMaker AI Savings Plan for one year

  Incorrect

  SageMaker AI Savings Plans lower the price of SageMaker AI usage; they are a pricing commitment and do not secure instances for set dates.

• DWarm pools that keep instances after each job

  Incorrect

  Warm pools retain infrastructure after a training job to speed up later jobs; they do not reserve capacity in advance.

For scarce accelerators on a known schedule, reserve the capacity ahead of time rather than relying on on-demand or spot availability.

• AOne public IP address per training instance

  Incorrect

  Training in private subnets does not need public IP addresses.

• BAt least 5 private IPs per EFA instance

  Correct

  AWS guidance says training instances that use an Elastic Fabric Adapter should have at least 5 private IP addresses, and instances without EFA at least 2, so the subnet must have enough free addresses.

• CA NAT gateway per training instance

  Incorrect

  NAT gateways provide outbound internet access, not private IP addresses for instances.

• DAn Elastic IP for the training job

  Incorrect

  Elastic IPs are public addresses and do not solve a shortage of private addresses in the subnet.

Plan subnet sizes for ML jobs: multi-instance and EFA-enabled training uses several private IP addresses per instance.

• AThe faiss engine for the vector field

  Correct

  The documentation says the vector engine used for search must be faiss.

• BA text field and a Bedrock-managed metadata field

  Correct

  The field mapping includes a text field for the raw chunk text and a Bedrock-managed metadata field, alongside the vector field.

• CThe nmslib engine for the vector field

  Incorrect

  The documentation states that nmslib is not supported.

• DA partition key named after each source document

  Incorrect

  A partition key is not part of the vector store field mapping for a knowledge base.

• EA DynamoDB table that holds the chunk text

  Incorrect

  Chunk text is stored in the vector store's text field, not in a separate DynamoDB table.

Bring-your-own vector stores need the right engine and a field mapping: a vector field, a text field and a metadata field.

• AAgentCore Memory

  Incorrect

  Memory stores conversation context; it does not manage user credentials for third-party services.

• BAgentCore Observability

  Incorrect

  Observability traces and monitors agents; it does not grant access to external services.

• CAgentCore Identity

  Correct

  AgentCore Identity provides identity and credential management for agents, enabling them to access AWS resources and third-party services on behalf of users while keeping security controls and audit trails.

• DAgentCore Code Interpreter

  Incorrect

  Code Interpreter runs code in a sandbox; it is not a credential management service.

Agents acting for users need delegated, auditable credentials; AgentCore Identity provides them so secrets stay out of agent code.

• AAttach a broader IAM policy to the execution role

  Incorrect

  The failure is a quota limit, not missing permissions; a wider role policy does not raise account quotas.

• BAdd more private subnets to the VPC settings

  Incorrect

  Subnets supply IP addresses for the instances; they do not change the account's instance quota.

• CRetry the job until enough capacity is free

  Incorrect

  Retrying does not help, because the quota stays the same until an increase is approved.

• DRequest a quota increase in Service Quotas

  Correct

  You can view SageMaker AI quotas and request increases for adjustable quotas through Service Quotas; smaller increases are often approved automatically.

Plan quotas before large ML jobs: instance quotas for training, hosting and other uses are separate and may need increases in new accounts.