MLS-C01 Data Engineering Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-data-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/24"
        }
      }
    }
  ]
}

A data engineer has attached the above IAM policy to an IAM role used by an AWS Glue ETL job. The job reads from and writes to 'my-data-bucket'. The job is failing with an Access Denied error. What is the most likely cause?

⚠ Common exam trap

Many exam-takers assume the IAM policy is missing a permission like s3:ListBucket, but the real issue is the IP condition that inadvertently blocks the Glue service because its source IPs are not within the specified range.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition restricts access to a specific IP range that does not include the AWS Glue service IPs.

The IAM policy includes a condition that restricts access to requests originating from a specific IP address range. AWS Glue ETL jobs run on ephemeral compute resources that use a dynamic pool of IP addresses, which are not guaranteed to fall within any fixed customer-managed IP range. Therefore, the condition causes the Access Denied error because the Glue service IPs are not within the allowed range.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The condition restricts access to a specific IP range that does not include the AWS Glue service IPs.
Why this is correct
The condition requires the request source IP to be in 10.0.0.0/24, but Glue's IPs are different.
✗
The IAM role needs to have s3:ListBucket permission.
Why it's wrong here
While ListBucket may be needed, the immediate error is likely due to the IP condition.
✗
The IAM role does not have permission to list the bucket.
Why it's wrong here
The policy allows GetObject and PutObject, but not ListBucket, which might be needed for listing objects.
✗
The resource ARN should include the bucket itself, not just the objects.
Why it's wrong here
The bucket ARN is missing for bucket-level operations, but the error is Access Denied, not a policy syntax issue.

Go deeper

Practice tests

Quick scored rounds with instant marking and a written explanation per question.

MLS-C01 Practice Test 5 — 25 Questions→Free MLS-C01 Practice Test 2 — 30 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Data Engineering Machine Learning Implementation and Operations Modeling

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Data Engineering practice questions Machine Learning Implementation and Operations practice questions Modeling practice questions MLS-C01 fundamentals practice questions

Continue studying

All MLS-C01 questions MLS-C01 practice test Study guide

This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.

MLS-C01 Data Engineering Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question