AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions
A data scientist is using Amazon SageMaker to train a model with data that resides in an S3 bucket owned by another AWS account. The training job fails with access denied errors. The data scientist has already been granted cross-account read access to the S3 bucket via a bucket policy. What additional configuration is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the SageMaker execution role to include an s3:GetObject permission for the bucket and ensure the bucket policy grants access to that role
SageMaker training jobs run within a SageMaker execution role. The role must have a trust policy allowing SageMaker to assume it, and the role must have permissions to read from the S3 bucket. The bucket policy alone is insufficient if the execution role does not have the necessary S3 permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the SageMaker execution role to include an s3:GetObject permission for the bucket and ensure the bucket policy grants access to that role
Why this is correct
The execution role must have explicit S3 read permissions, and the bucket policy must allow the role (or the account) to access the objects.
- ✗
Add an AWS KMS key policy to allow cross-account decryption
Why it's wrong here
The issue is access denied, not encryption. If KMS is used, the key policy would also need cross-account access, but that is not the primary issue described.
- ✗
Create a new VPC peering connection between the two accounts
Why it's wrong here
VPC peering is not required for S3 access; S3 is accessed over the internet or via VPC endpoints.
- ✗
Use AWS Lake Formation to grant cross-account permissions on the S3 data
Why it's wrong here
Lake Formation is for data lake permissions but requires additional setup; it's not the typical fix for this common cross-account S3 access issue.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AIF-C01 question from scratch — 619 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.