Question 1,261 of 1,672
MLS-C01 Practice Question: Machine Learning Implementation and Operations
A company is using Amazon SageMaker to deploy a model for real-time predictions. The model requires access to a DynamoDB table to look up features. The SageMaker endpoint is configured with a VPC and subnet. However, the endpoint cannot connect to DynamoDB. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to assume the issue is IAM permissions (Option B) or security group rules (Option A), overlooking the fundamental network routing requirement for private VPC resources to access public AWS services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC does not have a VPC endpoint for DynamoDB or a NAT gateway
A SageMaker endpoint deployed in a VPC, by default, cannot access public AWS services like DynamoDB unless the VPC has a VPC endpoint for DynamoDB (Gateway endpoint) or a NAT gateway to route traffic through an internet gateway. Without either, the endpoint's private subnet has no route to DynamoDB's public endpoints, causing the connection failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group does not allow outbound traffic to DynamoDB
Why it's wrong here
Security groups control traffic but DynamoDB access is via VPC endpoint or NAT.
- ✗
The IAM role for the endpoint does not have dynamodb:GetItem permission
Why it's wrong here
If permissions are missing, that would cause access denied, but the symptom indicates connectivity.
- ✓
The VPC does not have a VPC endpoint for DynamoDB or a NAT gateway
Why this is correct
Without a route to DynamoDB, the endpoint cannot connect.
- ✗
The DynamoDB table is in a different AWS Region
Why it's wrong here
Cross-region access is possible with proper setup.
- ✗
The CloudWatch logs show no errors
Why it's wrong here
CloudWatch logs are not the cause.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.