Monitoring, Maintenance & Security

A model that trained cleanly and deployed cleanly can still fail you in production: it drifts as the world changes, it quietly runs up a bill on the wrong instance family, and it holds data that must not leak. This domain covers the three jobs that keep a live ML system healthy, and the most useful move on an exam question is to name which of the three it is asking about. Watching for silent decay is monitoring. Paying only for the capacity you actually need is cost and infrastructure optimization. Keeping the workload's access, network, keys, and audit trail correct is security. These are three concurrent concerns, not a pipeline: a live endpoint is monitored, kept affordable, and secure at once. Most stems test exactly one, and the trap dresses one as another, most often a cost question written to look like a performance question, or a security question written to look like a networking question. Name the job first and the right SageMaker AI feature or AWS service usually follows.

Read this page as a map, then use the three subtopics as the homes a question can land in. Model & Data Monitoring owns accuracy over time: it turns on Data Capture, baselines the training data, and runs SageMaker Model Monitor and CloudWatch alarms to catch data drift and concept drift, plus A/B and shadow tests to validate a candidate before you trust it. Infrastructure & Cost Optimization owns keeping a healthy model affordable: it matches the instance family to the bottleneck, rightsizes with Inference Recommender and Compute Optimizer, buys the right purchasing option (On-Demand, Spot, Savings Plans), and attributes spend with cost allocation tags, Cost Explorer, and AWS Budgets. Securing ML Resources owns access and protection: it locks the workload down along four control families, access, network, encryption, and audit, using the IAM execution role, VpcConfig and network isolation, AWS KMS, and CloudTrail. All three apply to the same running endpoint at once; read them in the listed order only because you must see a problem before you size or secure around it. Each subtopic carries its mechanisms, limits, and traps.

Across all three jobs the exam rewards the same instinct: prefer the purpose-built managed feature to a do-it-yourself equivalent. For drift, that means SageMaker Model Monitor with a Clarify-backed baseline rather than a custom Lambda diffing distributions. For cost, it means a Savings Plan or Spot for the usage shape rather than manually stopping instances, and Compute Optimizer or Inference Recommender rather than guessing at a size. For security, it means the scoped IAM execution role, KMS, and VPC endpoints rather than bespoke gatekeeping. The managed, least-privilege, right-sized default is the exam-correct answer far more often than not, and each subtopic shows where the genuine exceptions live.