MLA-C01 Cheatsheet — SageMaker, MLOps, Endpoint Types, Monitoring & Security (High Yield)

Keep this page open while drilling questions. MLA‑C01 rewards “production ML realism”: data quality gates, repeatability, safe deployments, drift monitoring, cost controls, and least-privilege security.

Quick facts (MLA-C01)

Fast strategy (what the exam expects)

• If the question says best-fit managed ML, the answer is often SageMaker (Feature Store, Pipelines, Model Registry, managed endpoints).
• If the scenario is “data is messy,” think data quality checks, profiling, transformations, and feature consistency (train/serve).
• If the scenario is “accuracy dropped in prod,” think drift, monitoring baselines, A/B or shadow, and retraining triggers.
• If the scenario is “cost is spiking,” think right-sizing, endpoint type selection, auto scaling, Spot / Savings Plans, and budgets/tags.
• If there’s “security/compliance,” include least privilege IAM, encryption, VPC isolation, and audit logging.
• Read the last sentence first to capture constraints: latency, cost, ops effort, compliance, auditability.

Domain weights (how to allocate your time)

0) SageMaker service map (high yield)

1) End-to-end ML on AWS (mental model)

    flowchart LR
	  S["Sources"] --> I["Ingest"]
	  I --> T["Transform + Quality Checks"]
	  T --> F["Feature Engineering + Feature Store"]
	  F --> TR["Train + Tune"]
	  TR --> E["Evaluate + Bias/Explainability"]
	  E --> R["Register + Approve"]
	  R --> D["Deploy Endpoint or Batch"]
	  D --> M["Monitor Drift/Quality/Cost/Security"]
	  M -->|Triggers| RT["Retrain"]
	  RT --> TR

High-yield framing: MLA‑C01 is about the pipeline, not just the model.

2) Domain 1 — Data preparation (28%)

“Which tool should I use?” (ETL and prep picker)

Data formats (pickers)

Rule: choose formats based on access patterns (scan vs selective reads), schema evolution, and scale.

Data ingestion and storage (high yield)

• Amazon S3: default data lake for ML (durable, cheap, scalable).
• Amazon EFS / FSx: file-based access patterns; useful when training expects POSIX-like file semantics.
• Streaming ingestion: use Kinesis/managed streaming where low-latency data arrival matters.

Common best answers:

• Use AWS Glue / Spark on EMR for big ETL jobs.
• Use SageMaker Data Wrangler for fast interactive prep and repeatable transformations.
• Use SageMaker Feature Store to keep training/inference features consistent.

Feature Store: why it matters

• Avoid train/serve skew: the feature used in training is the same feature served to inference.
• Support feature reuse across teams and models.
• Enable governance: feature definitions and versions.

Data integrity + bias basics (often tested)

High-yield rule: don’t “fix” model issues before you verify data quality and leakage.

3) Domain 2 — Model development (26%)

Choosing an approach

Rule: don’t overbuild. If an AWS managed AI service solves it, it usually wins on time-to-value and ops.

Training and tuning (high yield)

• Training loop terms: epoch, step, batch size.
• Speedups: early stopping, distributed training.
• Generalization controls: regularization (L1/L2, dropout, weight decay) + better data/features.
• Hyperparameter tuning: random search vs Bayesian optimization; in SageMaker, use Automatic Model Tuning (AMT).

Metrics picker (what to choose)

Overfitting vs underfitting (signals)

Clarify vs Debugger vs Model Monitor (common confusion)

Model Registry (repeatability + governance)

• Track: model artifacts, metrics, lineage, approvals.
• Enables safe promotion/rollback and audit-ready workflows.

4) Domain 3 — Deployment and orchestration (22%)

Endpoint types (must-know picker)

Scaling metrics (what to pick)

Multi-model / multi-container (why they exist)

• Multi-model: multiple models behind one endpoint to reduce cost.
• Multi-container: pre/post-processing plus model serving, or multiple frameworks.

IaC + containers (exam patterns)

• IaC: CloudFormation or CDK for reproducible environments.
• Containers: build/publish to ECR, deploy via SageMaker, ECS, or EKS.

CI/CD for ML (what’s different)

You version and validate more than code:

• Code + data + features + model artifacts + evaluation reports
• Promotion gates: accuracy thresholds, bias checks, smoke tests, canary/shadow validation

Typical services: CodePipeline/CodeBuild/CodeDeploy, SageMaker Pipelines, EventBridge triggers.

    flowchart LR
	  G["Git push"] --> CP["CodePipeline"]
	  CP --> CB["CodeBuild: tests + build"]
	  CB --> P["SageMaker Pipeline: process/train/eval"]
	  P --> Gate{"Meets<br/>thresholds?"}
	  Gate -->|yes| MR["Model Registry approve"]
	  Gate -->|no| Stop["Stop + report"]
	  MR --> Dep["Deploy (canary/shadow)"]
	  Dep --> Mon["Monitor + rollback triggers"]

5) Domain 4 — Monitoring, cost, and security (24%)

Monitoring and drift (high yield)

• Data drift: input distribution changed.
• Concept drift: relationship between input and label changed.
• Use baselines + ongoing checks; monitor latency/errors too.

Common services/patterns:

• SageMaker Model Monitor for monitoring workflows.
• A/B testing or shadow deployments for safe comparison.

Monitoring checklist (what to instrument)

• Inference quality: when ground truth is available later, compare predicted vs actual.
• Data quality: nulls, ranges, schema changes, category explosion.
• Distribution shift: feature histograms/summary stats vs baseline.
• Ops signals: p50/p95 latency, error rate, throttles, timeouts.
• Safety/security: anomalous traffic spikes, abuse patterns, permission failures.

Infra + cost optimization (high yield)

Cost levers (common “best answer” patterns)

• Choose the right inference mode first: batch (cheapest) → async → serverless → real-time (most always-on).
• Right-size and auto scale; don’t leave endpoints overprovisioned.
• Use Spot for fault-tolerant training/batch where interruptions are acceptable.
• Use Budgets + tags early (before the bills surprise you).

Security defaults (high yield)

• Least privilege IAM for training jobs, pipelines, and endpoints.
• Encrypt at rest + in transit (KMS + TLS).
• VPC isolation (subnets + security groups) for ML resources when required.
• Audit trails (CloudTrail) + controlled access to logs and artifacts.

Common IAM/security “gotchas”

• Training role can read S3 but can’t decrypt KMS key (KMS key policy vs IAM policy mismatch).
• Endpoint role has broad S3 access (“*”) instead of a tight prefix.
• Secrets leak into logs/artifacts (build logs, notebooks, environment variables).
• No audit trail for model registry approvals or endpoint updates.

Next steps

• Use the Syllabus as your checklist.
• Use Practice to drill weak tasks fast.
• Use the Study Plan if you want a 30/60/90‑day schedule.