A. Incorrect.
Manual installation is not repeatable across processing, training, and pipeline jobs and can cause environment drift.

B. Correct.
A custom container in Amazon ECR gives every SageMaker job the same reusable runtime and dependency set.

C. Incorrect.
Notebook startup scripts affect the notebook environment, not the managed runtime for production SageMaker jobs.

D. Incorrect.
Running outside SageMaker adds orchestration work and loses the managed SageMaker pipeline workflow.

A. Incorrect.
Adding layers increases model capacity and can make overfitting worse, even if early stopping may help.

B. Correct.
The training-validation gap indicates overfitting; dropout, regularization, and cross-validation improve generalization.

C. Incorrect.
PCA can reduce dimensionality, but changing the loss function is not the targeted fix for overfitting in this scenario.

D. Incorrect.
Data quality and sampling may help some problems, but they do not directly address high-variance overfitting.

A. Incorrect.
SageMaker model hosting does not provide managed sensitive-data discovery for S3 objects.

B. Incorrect.
ECS and Batch add custom infrastructure and do not provide native S3 sensitive-data discovery.

C. Correct.
Macie is purpose-built to discover sensitive data in S3, and Lambda can automate cleanup or redaction.

D. Incorrect.
Comprehend can detect entities in text, but EC2 cleanup is more operationally heavy than Macie with Lambda.

A. Incorrect.
S3 lifecycle rules manage object storage transitions and expiration; they do not start ML pipelines.

B. Incorrect.
Scanning introduces polling code and delay when an event-driven integration is available.

C. Correct.
EventBridge can react to S3 upload events and start a SageMaker pipeline without custom polling infrastructure.

D. Incorrect.
MWAA is powerful for complex workflows, but it is unnecessary overhead for a simple S3 event trigger.

A. Incorrect.
All On-Demand is reliable but not the most cost-effective choice when task nodes can use Spot capacity.

B. Incorrect.
Spot interruptions on primary or core nodes can risk cluster stability and data stored in HDFS.

C. Incorrect.
Core nodes store data and should not use interruptible Spot capacity when data loss is unacceptable.

D. Correct.
Primary and core nodes stay reliable on On-Demand, while task nodes can use Spot for lower-cost compute.

A. Correct.
The application must invoke the Bedrock model to generate images.

B. Incorrect.
Read-only Bedrock actions do not run inference.

C. Correct.
The application must receive SQS messages and delete them after successful processing.

D. Incorrect.
Getting queue attributes does not allow message consumption.

E. Incorrect.
SageMaker permissions are unrelated to invoking a Bedrock foundation model.

A. Incorrect.
Debugger helps inspect training jobs, not evaluate a new endpoint model with mirrored live traffic.

B. Incorrect.
All-at-once shifting affects production users immediately.

C. Incorrect.
Canary shifting sends some user traffic to the new model, which can affect users.

D. Correct.
Shadow testing mirrors live traffic to the new model while production responses still come from the current model.

A. Correct.
Hyperband reduces compute by allocating more resources to promising configurations and stopping weak ones early.

B. Incorrect.
Grid search is usually expensive because it evaluates every combination.

C. Incorrect.
Bayesian optimization is efficient, but Hyperband is specifically designed to reduce training time by early stopping poor runs.

D. Incorrect.
Random search can be better than grid search, but it does not adaptively stop underperforming configurations like Hyperband.

A. Incorrect.
Weekly polling can miss the 24-hour target and adds custom logic.

B. Incorrect.
A fixed schedule does not guarantee that data is ready or that the pipeline starts soon after upload.

C. Incorrect.
S3 lifecycle rules do not trigger ML workflows.

D. Correct.
EventBridge can start the workflow immediately after upload, and Step Functions can orchestrate training and Model Registry registration.

A. Correct.
Secrets Manager is designed to store secrets and supports scheduled custom rotation with Lambda.

B. Incorrect.
Parameter Store can store values, but Secrets Manager provides built-in secret rotation workflows.

C. Incorrect.
KMS rotates encryption keys, not application API tokens.

D. Incorrect.
AWS owned KMS keys do not manage or rotate third-party API tokens.