AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions
A company uses Amazon Macie to discover sensitive data in an S3 bucket containing training datasets. The bucket policy currently prohibits access from external accounts. Which TWO steps are necessary to allow a cross-account SageMaker training job to access this bucket while maintaining security?
⚠ Common exam trap
AIF-C01 often tests the misconception that a single policy (either identity-based or resource-based) suffices for cross-account access, when in fact both sides must explicitly grant permission.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy that grants the SageMaker execution role from the other account s3:GetObject and s3:ListBucket permissions
Option C is correct because the S3 bucket policy is the resource-based policy that must explicitly grant the cross-account SageMaker execution role access; since the bucket currently prohibits external accounts, you must add a statement allowing that role principal s3:GetObject and s3:ListBucket on the bucket and its objects. Option D is correct because the SageMaker execution role in the other account also needs an identity-based IAM policy permitting s3:GetObject and s3:ListBucket on the source bucket, since cross-account access requires both the identity policy and the resource policy to allow the action. Option A is wrong because Macie is a data-discovery and classification service and cannot grant access to a SageMaker execution role. Option B is wrong because an S3 VPC endpoint only affects private network routing for traffic within a VPC and does not by itself authorize cross-account access. Option E is wrong because removing the bucket policy's external-access prohibition would broadly open the bucket rather than securely scoping access to the SageMaker execution role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Macie to automatically grant access to the SageMaker execution role
Why it's wrong here
Macie is a discovery and classification service; it holds no IAM permission to grant roles access to S3 objects, so it cannot authorise the SageMaker execution role. Macie is correctly used to identify sensitive data for labelling, not to manage bucket access.
- ✗
Create a VPC endpoint for S3 and associate it with the SageMaker VPC
Why it's wrong here
A VPC endpoint changes the network path from the SageMaker VPC to S3; it does not alter the bucket policy that denies external accounts, so the cross-account request is still refused. Endpoints are the right choice when traffic must stay off the public internet, not when authorising a foreign account.
- ✓
Add a bucket policy that grants the SageMaker execution role from the other account s3:GetObject and s3:ListBucket permissions
Why this is correct
The bucket policy is the resource-based control that explicitly overrides the current prohibition on external accounts. Granting the cross-account SageMaker execution role s3:GetObject and s3:ListBucket authorises that principal directly, satisfying the cross-account access requirement while keeping the bucket closed to everyone else.
- ✓
Attach an IAM policy to the SageMaker execution role that allows s3:GetObject and s3:ListBucket on the source bucket
Why this is correct
The execution role's identity-based policy authorises the SageMaker training job itself to call s3:GetObject and s3:ListBucket on the source bucket. Without this, the job's own credentials lack permission, so the cross-account request fails even if the bucket policy permits it.
- ✗
Remove the bucket policy that prohibits external access
Why it's wrong here
Removing the bucket policy strips the guardrail entirely, exposing the training data to every principal rather than the SageMaker execution role alone. Bucket policies are removed when decommissioning a bucket or deliberately making data public, not when granting scoped cross-account access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 862 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.