AWS Secrets Manager is designed for securely storing, managing, and automatically rotating secrets, including API tokens. By configuring a Lambda function for custom rotation logic, the solution can automatically rotate the API tokens every 3 months as required. Secrets Manager simplifies secret management and integrates seamlessly with other AWS services, making it the ideal choice for this use case.

Amazon FSx for NetApp ONTAP allows mounting the file system as a network-attached storage (NAS) volume. Since the FSx for ONTAP file system and SageMaker instance are in the same VPC, you can directly mount the file system to the SageMaker instance. This approach ensures efficient access to the 6 TB of training data without the need to duplicate or transfer the data, meeting the requirements with minimal complexity and operational overhead.

The task described is unsupervised topic modeling, where topics are unknown in advance. Latent Dirichlet Allocation (LDA) is a probabilistic generative model specifically designed to discover latent topics from a corpus of documents without labeled data. AWS provides LDA as a built-in algorithm in Amazon SageMaker, making it well suited for this requirement.

LDA models documents as mixtures of topics and topics as mixtures of words, enabling interpretable topic discovery at scale. This aligns precisely with the need to organize documents into topics when the topics are not predefined.

BlazingText is optimized for word embeddings and supervised text classification, not topic modeling. Sequence-to-sequence models are used for translation or summarization. Object2Vec creates embeddings but does not itself perform topic discovery without additional clustering steps.

Therefore, LDA is the correct and purpose-built solution.

AWS Glue Data Quality provides managed, declarative data quality checks with minimal configuration. Combined with Glue crawlers, it enables automatic schema discovery and quality validation without custom code.

Option A uses native AWS services designed for this exact purpose, minimizing operational overhead. Options B and C require custom code and maintenance. Option D is not designed for data validation.

AWS documentation explicitly recommends Glue Data Quality rules for scalable, automated data quality checks in analytics pipelines.

Therefore, Option A is the correct and AWS-aligned solution.

This is a regression problem, where the target variable is continuous and numeric. AWS documentation clearly states that classification metrics such as accuracy and AUC are not appropriate for regression models.

Root Mean Square Error (RMSE) measures the square root of the average squared differences between predicted and actual values. RMSE penalizes larger errors more heavily, making it especially useful when large prediction errors are costly or undesirable.

SageMaker Canvas automatically selects regression metrics such as RMSE and MAE when building regression models. RMSE is widely used for time-based and numeric prediction problems, especially when evaluating long historical datasets.

Inference latency measures system performance, not model accuracy.

Therefore, Option D is the correct and AWS-verified answer.

The correct answer is A. Create Amazon Managed Streaming for Apache Kafka (Amazon MSK) Serverless clusters to process the data.

Amazon MSK Serverless allows organizations to run Apache Kafka workloads without managing or provisioning the underlying infrastructure. Unlike MSK Provisioned clusters (Option B), serverless clusters automatically scale to accommodate variable workloads and handle operational tasks such as patching, scaling, and monitoring. This meets the company’s requirement to avoid managing or scaling infrastructure while providing near real-time streaming analytics.

Option C, using Amazon Kinesis Data Streams with Application Auto Scaling, provides a managed streaming solution but is not based on open-source technology. While Kinesis can handle near real-time data, the question specifically emphasizes the company’s desire for open-source technology, which points toward Kafka.

Option D, self-hosting Apache Flink on EC2, requires manual management of servers, scaling, patching, and container orchestration. This approach contradicts the requirement of not managing or scaling infrastructure and introduces operational complexity.

MSK Serverless provides seamless integration with open-source Kafka APIs, enabling applications to produce and consume streaming data in real time while AWS handles scaling and availability. It is ideal for analytics pipelines where data ingestion is continuous and variable, and infrastructure overhead must be minimized.

By choosing MSK Serverless, the company can implement near real-time updates for its analytics platform using open-source Kafka without the operational burden of cluster management, fully aligning with AWS best practices for deployment and orchestration of ML workflows in a managed, scalable, and serverless manner.

An oscillating loss pattern during training with stochastic gradient descent (SGD) is a strong indicator that the learning rate is too high. When the learning rate is excessive, the optimizer takes overly large steps during gradient updates, causing the model to repeatedly overshoot the optimal minimum of the loss function. This results in unstable convergence behavior, where training and validation loss decrease briefly and then increase again in a repeating cycle.

AWS Machine Learning documentation and general deep learning best practices recommend reducing the learning rate when training loss and validation loss both remain high and fluctuate rather than steadily decreasing. Lowering the learning rate allows the optimizer to take smaller, more precise steps toward the minimum, leading to smoother convergence and improved generalization on the test dataset.

Option A, early stopping, is used primarily to prevent overfitting when validation loss increases while training loss continues to decrease. In this scenario, both losses remain high and unstable, indicating an optimization issue rather than overfitting.

Option B is incorrect because increasing the test set size does not affect the training dynamics or convergence behavior of the model.

Option C would worsen the problem, as increasing the learning rate would further amplify oscillations and instability.

Therefore, decreasing the learning rate is the correct corrective action to stabilize SGD training and improve model performance.

The correct answer is A. Ingest real-time data into Amazon Kinesis data streams. Use the built-in RANDOM_CUT_FOREST function in Amazon Managed Service for Apache Flink to process the data streams and to detect data anomalies.

Amazon Kinesis Data Streams is a fully managed service that can handle high-volume, real-time data streams with low latency and high scalability. By integrating Amazon Managed Service for Apache Flink (MSK for Flink) with the built-in RANDOM_CUT_FOREST (RCF) algorithm, the company can perform real-time anomaly detection directly on streaming data without building or managing custom infrastructure. RCF is designed for unsupervised anomaly detection on streaming datasets, making it ideal for financial market data that arrives continuously and at high velocity.

Option B adds operational complexity because it requires deploying a SageMaker endpoint, setting up Lambda functions, and maintaining the orchestration between Kinesis and Lambda. Option C further increases overhead by requiring self-managed Apache Kafka clusters on EC2, combined with SageMaker and Lambda orchestration. Option D introduces SQS and batch ETL processing via AWS Glue, which is not suitable for real-time anomaly detection and significantly increases latency.

Using Kinesis + Managed Flink + RCF provides a serverless, fully managed, and scalable solution with minimal operational overhead. It handles ingestion, streaming processing, and anomaly detection natively. The architecture eliminates the need for provisioning compute clusters or managing real-time orchestration, reducing operational cost while achieving sub-second detection for thousands of JSON records per second.

This approach aligns with AWS best practices for ML solution monitoring, maintenance, and security, particularly for real-time anomaly detection in high-volume, structured or semi-structured data streams.

In Amazon SageMaker, distributed training and distributed processing jobs often involve multiple instances exchanging data over the network. By default, when these jobs run inside a VPC, network traffic remains private but is not automatically encrypted between instances. When compliance or security requirements mandate encryption of in-transit data, additional configuration is required.

The correct solution is to enable inter-container traffic encryption, which ensures that all network communication between containers running on different instances is encrypted using TLS. Amazon SageMaker provides a built-in feature for this purpose. When inter-container traffic encryption is enabled, SageMaker automatically configures secure communication channels between all nodes participating in a distributed job, including training clusters and processing jobs.

Option A (Network isolation) is incorrect because network isolation prevents containers from making outbound network calls and accessing the internet. It does not encrypt traffic between instances.

Option B (Security groups) is incorrect because security groups control network access and traffic flow, not encryption. They can restrict which instances can communicate, but they do not provide data-in-transit encryption.

Option D (VPC flow logs) is incorrect because VPC flow logs are used for monitoring and auditing network traffic, not for encrypting it.

AWS documentation explicitly states that enabling inter-container traffic encryption is the recommended and supported approach for encrypting data exchanged between instances during distributed SageMaker jobs. This feature aligns with enterprise security best practices and regulatory requirements for protecting sensitive ML training data in transit.

Therefore, Option C is the only solution that directly fulfills the encryption requirement for distributed SageMaker workloads.

The model is underperforming in production due to variations in image quality from different cameras. Using the corrupt image transform with the impulse noise option in SageMaker Data Wrangler simulates real-world noise and variations in the training dataset. This approach helps the model become more robust to inconsistencies in image quality, improving its accuracy in production without the need to collect and process new data, thereby saving time.