A court clerk's document-inference SageMaker endpoint handles sensitive docket text and must not be reachable from the public internet. Which deployment choice satisfies this requirement?
Select an answer to reveal the explanation.
Short Explanation
Keeping an endpoint off the public internet is like moving a conversation from the sidewalk into a locked office — same conversation, no passersby. A VPC-only deployment keeps the traffic on the private network end to end. Anything that still leaves a public front door open isn't the fix.
Full Explanation
Deploying a SageMaker endpoint with a VPC configuration keeps inference traffic on the account's private network rather than routing it over the public internet, which directly satisfies a requirement that sensitive docket text never be reachable from outside — the network path itself is restricted, not just the application logic sitting in front of it. Relying on an application login screen leaves the underlying endpoint reachable at the network layer; authentication controls who can use a front door that's still facing the street, rather than removing the street-facing exposure itself. Extending token expiration changes how long a credential remains valid, which is an authentication detail unrelated to whether the endpoint's network path is public or private. Adding more Availability Zones improves availability and fault tolerance, not confidentiality — a highly available public endpoint is still a public endpoint. Scope caveat: a VPC-only endpoint still needs the calling application to reach it over the private network path (for example, through a VPC endpoint or a peered connection), so confirm that path exists before assuming connectivity works end to end. Operational check: attempt to reach the endpoint from outside the VPC and confirm the request fails, rather than only confirming it succeeds from inside.