AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions
A company uses Amazon Macie to discover sensitive data in an S3 bucket containing training datasets. The bucket policy currently prohibits access from external accounts. Which TWO steps are necessary to allow a cross-account SageMaker training job to access this bucket while maintaining security?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy that grants the SageMaker execution role from the other account s3:GetObject and s3:ListBucket permissions
For cross-account access, the bucket policy must grant the required permissions to the SageMaker execution role (from the other account), and the SageMaker execution role must have an IAM policy that allows it to access the S3 bucket. Macie doesn't control access. VPC endpoints are optional.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Macie to automatically grant access to the SageMaker execution role
Why it's wrong here
Macie is for data discovery, not access control.
- ✗
Create a VPC endpoint for S3 and associate it with the SageMaker VPC
Why it's wrong here
VPC endpoints are not required for cross-account access; they are used for private connectivity.
- ✓
Add a bucket policy that grants the SageMaker execution role from the other account s3:GetObject and s3:ListBucket permissions
Why this is correct
The bucket policy must explicitly allow the cross-account role.
- ✓
Attach an IAM policy to the SageMaker execution role that allows s3:GetObject and s3:ListBucket on the source bucket
Why this is correct
The role must have permissions to access the bucket.
- ✗
Remove the bucket policy that prohibits external access
Why it's wrong here
That would weaken security; the policy can be modified to allow specific cross-account access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.