The Amazon SageMaker Model Registry is designed to manage and catalog ML models, including those hosted in Amazon ECR. By creating a model group for each model in the SageMaker Model Registry and setting up cross-account resource policies, the company can establish a central catalog in a new AWS account.
This allows all models from the initial accounts to be accessible in a unified, centralized manner for better organization, management, and governance. This solution leverages existing AWS services and ensures scalability and minimal operational overhead.

Option A is correct because Amazon SageMaker Model Monitor is the AWS service specifically built to monitor data quality and model quality for ML models in production. AWS documentation states that Model Monitor supports continuous monitoring with a batch transform job that runs regularly and also supports on-schedule monitoring for asynchronous batch transform jobs . That aligns directly with the scenario of a hospital running a nightly batch inference job and needing a daily report on both the incoming data and the model's predictive performance.
AWS documentation also separates the two monitoring needs very clearly. Data quality monitoring can be scheduled for batch transform jobs by using DefaultModelMonitor with a BatchTransformInput. Model quality monitoring can also be scheduled for batch transform jobs by using ModelQualityMonitor, which compares predictions against actual ground-truth labels stored in Amazon S3. Since the question explicitly asks for both model data quality and model performance , SageMaker Model Monitor is the documented feature that covers both requirements together.
Option B is not sufficient because CloudWatch dashboards show operational and resource metrics, not the full ML-specific data quality and model quality reports required here. Option C is incorrect because AWS Glue DataBrew is for data preparation and profiling, not model performance monitoring. Option D is partially plausible because SageMaker Pipelines integrates with QualityCheck steps and can run monitoring jobs on demand, but the AWS docs position Model Monitor as the native solution for scheduled monitoring of production batch inference workloads. Therefore, the best AWS-documented answer is A .

Network ACLs (Access Control Lists) operate at the subnet level and allow for rules to explicitly deny traffic from specific IP addresses. By creating an inbound rule in the network ACL to deny traffic from the suspicious IP address, the company can block traffic to the Amazon SageMaker domain from that IP. This approach works because network ACLs are evaluated before traffic reaches the security groups, making them effective for blocking traffic at the subnet level.

A sudden drop in model performance after a long period of stability is a classic indicator of data drift.
According to AWS ML documentation, production data distribution drift occurs when the statistical properties of incoming data change over time compared to the training dataset.
This drift can be caused by changes in user behavior, market conditions, seasonal trends, or upstream data pipelines. When drift occurs, the model's learned patterns no longer align with real-world data, leading to degraded accuracy and other performance metrics.
Lack of training data (Option A) and overfitting (Option D) are issues that typically manifest during initial training, not after months of stable production performance. Compute constraints (Option C) may affect latency but do not usually cause sustained accuracy degradation.
AWS recommends using SageMaker Model Monitor to detect such drift and trigger retraining workflows.
Therefore, drift in the production data distribution is the most likely cause of the observed performance degradation.

AWS Glue DataBrew supports datasets sourced directly from Amazon S3 paths. To clean and normalize data, AWS documentation specifies using DataBrew recipes, which define transformation steps such as standardization, deduplication, and formatting.
A profile job is used only for data analysis and statistics generation, not for transformation. A recipe job applies actual transformations to the data and writes the output to Amazon S3.
JDBC connections are used for relational databases, not S3 buckets. Therefore, options C and D are invalid.
AWS clearly documents that the correct workflow is:
Create a DataBrew dataset from an S3 path
Define transformations using a recipe
Run a recipe job to produce cleaned data
Thus, Option B is the correct and AWS-aligned answer.