mediumMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: A healthcare company is deploying a machine…
A healthcare company is deploying a machine learning model on Amazon SageMaker to analyze patient records. The model requires access to a DynamoDB table containing patient data. Which combination of AWS services and features should the company use to restrict access to only the necessary resources?
⚠ Common exam trap
The AIF-C01 exam often tests the misconception that DynamoDB supports resource-based policies like S3 bucket policies, but in reality DynamoDB only uses IAM identity-based policies for access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with a policy granting read-only access to the specific DynamoDB table and attach it to the SageMaker notebook instance
It follows the AWS principle of least privilege by creating an IAM role with a policy that grants read-only access to the specific DynamoDB table, then attaching that role to the SageMaker notebook instance. This ensures the notebook can only perform read operations on the required table without exposing long-term credentials or granting broader permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a DynamoDB resource-based policy to the table allowing access from the SageMaker notebook
Why it's wrong here
DynamoDB resource-based policies are not supported; IAM roles are required.
- ✓
Create an IAM role with a policy granting read-only access to the specific DynamoDB table and attach it to the SageMaker notebook instance
Why this is correct
This follows least-privilege principle and uses temporary credentials via IAM roles.
- ✗
Store AWS access keys in the notebook and use those credentials to access DynamoDB
Why it's wrong here
Embedding long-term credentials is insecure and violates best practices.
- ✗
Launch the SageMaker notebook in a VPC with a security group that allows access to DynamoDB
Why it's wrong here
VPC security groups control network traffic, not IAM permissions.
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.