A custom training image can still reach the public internet and an unexpected webhook. The job must not initiate outbound calls. What should they enable?
Select an answer to reveal the explanation.
Short Explanation
A custom training image can still reach the public internet and an unexpected webhook. Enable SageMaker network isolation so the container cannot start outbound calls. Opening 0.0.0.0/0 or moving to a public subnet increases egress.
Full Explanation
SageMaker network isolation blocks the container from initiating outbound calls. Complementary VPC settings keep the job off the public internet. Opening 0.0.0.0/0, calling Personalize, or moving to a public subnet increases egress instead of stopping it.