hardMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: A company uses Amazon SageMaker to train a model…
A company uses Amazon SageMaker to train a model on customer transaction data. The data is stored in an S3 bucket encrypted with SSE-KMS. The data scientists are using a SageMaker notebook instance to preprocess the data. The security team notices that the notebook instance can access the KMS key directly through the SageMaker console, even when the data scientists do not have explicit KMS permissions. What is the MOST likely reason for this behavior?
⚠ Common exam trap
Test-takers frequently assume the user's own IAM permissions are the only factor, but AWS services like SageMaker can proxy requests using the execution role attached to the resource, effectively decoupling the user's identity from the data access permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SageMaker execution role attached to the notebook instance has permission to use the KMS key for the S3 bucket, and the SageMaker console uses that role to perform decryption operations on behalf of the user.
The SageMaker notebook instance uses an execution IAM role that is assumed when performing operations. If that execution role has permissions to use the KMS key (e.g., kms:Decrypt, kms:GenerateDataKey) for the S3 bucket, the SageMaker console can leverage that role to decrypt data on behalf of the user, even if the user's own IAM identity lacks explicit KMS permissions. The console acts as a proxy, using the notebook's execution role to access the key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The KMS key policy allows the SageMaker service to decrypt using the key, and the console displays this permission globally.
Why it's wrong here
KMS key policies can allow the SageMaker service, but the console shows access based on the user's effective permissions, not the key policy alone.
- ✗
The S3 bucket has a bucket policy that grants s3:GetObject access using the SageMaker service principal, bypassing KMS permissions.
Why it's wrong here
S3 bucket policies do not bypass KMS; KMS still requires separate permissions.
- ✓
The SageMaker execution role attached to the notebook instance has permission to use the KMS key for the S3 bucket, and the SageMaker console uses that role to perform decryption operations on behalf of the user.
Why this is correct
The SageMaker execution role is assumed by the notebook instance and has KMS permissions. The console uses the role to show decryption status.
- ✗
The SageMaker notebook instance is using an IAM role that has the AWS managed policy AmazonSageMakerFullAccess, which includes kms:Decrypt for all keys.
Why it's wrong here
AmazonSageMakerFullAccess does not include kms:Decrypt for all keys; it only includes permissions for SageMaker resources.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.