MLA-C02 operating, monitoring and securing
Operating, Monitoring, and Securing ML and AI Solutions is worth 24% of MLA-C02. AWS frames it as maintaining observability to optimise efficiency and cost, monitoring models, agentic workflows, data and infrastructure to detect issues, and securing AI and ML systems through access controls and compliance features.
This is the domain that separates people who have run ML in production from people who have only built it.
Monitoring models
Infrastructure monitoring will not tell you a model has gone wrong. A degraded model is up, fast and answering — just worse.
What to watch:
- Data drift — the input distribution moves away from the training distribution.
- Concept drift — the relationship between inputs and the correct answer changes.
- Prediction quality, where ground truth eventually arrives.
- Baseline comparison — you cannot detect drift without having captured what normal looked like.
The exam signature is consistent: accuracy declining over time with no code, configuration or infrastructure change is a drift question, and the answer involves drift monitoring plus a retraining path.
Monitoring data and infrastructure
- Data quality checks in the pipeline, so bad input is caught before it reaches a model.
- Endpoint metrics: latency, invocation volume, errors, and utilisation.
- Logging and tracing to troubleshoot a failing pipeline.
- Alerting on thresholds that mean something operationally.
Observability for agentic workflows
Explicit in C02’s task list. Agents take multiple steps and call tools, so failures are distributed: you need to see which step ran, what a tool returned, and where a workflow stalled. Aggregate success rates hide the step that is actually failing.
Cost optimisation
AWS cares about this throughout the exam and names it in this domain’s task list:
- Right-sizing instances and choosing the correct inference pattern.
- Scaling to zero where traffic allows.
- Spot capacity for interruptible training.
- Storage lifecycle policies for data and artefacts.
- Token and request cost when using foundation models.
The instinct to carry: the cheapest option that meets the stated requirement is usually correct.
Securing ML and AI systems
- IAM and least privilege. Roles rather than long-lived access keys — whenever an option removes a stored credential, it is usually right.
- Encryption at rest and in transit for data, artefacts and endpoints.
- Network isolation — private connectivity rather than public endpoints where the requirement says traffic must not traverse the internet.
- Data protection, including what is sent to a foundation model.
- Compliance features and auditability: who called what, and when.
Sample questions
Question 1. A model's predictions have gradually worsened over eight months. Endpoint latency, error rate and infrastructure metrics are all normal, and nothing has been deployed. What should the engineer implement?
- A. Increase the endpoint instance size
- B. Restart the endpoint and clear its cache
- C. Drift monitoring against a data baseline, with a retraining trigger
- D. Increase log retention to capture more detail
Show answer
Answer: C
Gradual degradation with healthy infrastructure and no deployments is drift, so the response is drift monitoring against a captured baseline with a retraining trigger. Scaling the endpoint addresses throughput, restarting addresses transient faults, and more logging records the symptom without resolving it.
Question 2. A training job runs nightly, takes about four hours, and can safely be interrupted and resumed. The team wants to reduce cost. What is the most appropriate change?
- A. Move the training job to an on-demand GPU instance
- B. Run the training job on spot capacity with checkpointing
- C. Convert the training job to a real-time endpoint
- D. Reduce the training dataset size by half
Show answer
Answer: B
Spot capacity is substantially cheaper and suits interruptible workloads with checkpointing, which is exactly what a resumable nightly job is. On-demand GPU capacity is the expensive default, a real-time endpoint is for inference rather than training, and reducing the dataset degrades the model to save money.
Question 3. A model endpoint must be reachable only from within the organisation's VPC, never over the public internet. What should the engineer configure?
- A. A private VPC endpoint with public access disabled
- B. A public endpoint restricted by an IP allow-list
- C. An IAM policy limiting which principals may invoke it
- D. TLS encryption in transit on the public endpoint
Show answer
Answer: A
A private endpoint keeps traffic inside the VPC and removes public reachability, which is what the requirement states. An IP allow-list still leaves a public endpoint exposed, IAM controls authorisation rather than network reachability, and encryption in transit protects traffic without restricting where it can come from.
What to practise
Deploy one model and deliberately feed it input drawn from a different distribution than it trained on, with monitoring in place. Watch the infrastructure metrics stay perfectly healthy while quality collapses. That contrast is the core insight of this domain and it is worth seeing once rather than reading five times.