easyMultiple Choice
AIF-C01 Practice Question: Refer to the exhibit
Exhibit
Error: AccessDeniedException: User: arn:aws:sts::123456789012:assumed-role/SageMakerExecutionRole/... is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/abc123
Refer to the exhibit. A data scientist is training a model in SageMaker using a KMS-encrypted dataset. The training job fails with the error shown. Which action should be taken to resolve this issue?
⚠ Common exam trap
AWS often tests the distinction between IAM policies and KMS key policies; the trap here is that candidates assume attaching an IAM policy to the execution role (Option C) is sufficient, but KMS key policies must explicitly grant access to the role when the key is customer-managed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the SageMaker execution role to the KMS key policy with the kms:Decrypt permission.
The error indicates that the SageMaker training job cannot access the KMS-encrypted dataset. Since the S3 bucket uses server-side encryption with a customer-managed KMS key (SSE-KMS), the SageMaker execution role must be explicitly granted kms:Decrypt permission in the KMS key policy. Option A correctly adds this permission to the key policy, which is required for SageMaker to decrypt the data during training.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the SageMaker execution role to the KMS key policy with the kms:Decrypt permission.
Why this is correct
The key policy must explicitly grant the execution role the kms:Decrypt permission.
- ✗
Create a new KMS key and update the bucket policy to use the new key.
Why it's wrong here
Creating a new key does not resolve the permission issue; the role still needs access.
- ✗
Attach an IAM policy to the SageMaker execution role that allows kms:Decrypt on the key.
Why it's wrong here
While this could work, the key policy must also allow the role; modifying the key policy is more direct and commonly required.
- ✗
Disable server-side encryption on the S3 bucket and use client-side encryption.
Why it's wrong here
This weakens security and does not fix the access denied error.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AIF-C01 question from scratch — 862 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.