MLS-C01 Practice Question: Machine Learning Implementation and Operations
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob",
"sagemaker:DescribeTrainingJob"
],
"Resource": "*"
}
]
}
```A data scientist has this IAM policy attached to their IAM role. They are trying to run a SageMaker training job that reads data from 'my-bucket' and writes output to 'my-bucket'. The job fails. What is the most likely reason?
⚠ Common exam trap
The trap here is that candidates often focus on S3 permissions (like ListBucket) or assume the training job needs CloudWatch Logs, but the real blocker is the missing `iam:PassRole` permission, which is a common oversight when configuring IAM policies for SageMaker.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Missing iam:PassRole permission
The most likely reason the SageMaker training job fails is that the IAM role lacks the `iam:PassRole` permission. When SageMaker creates a training job, it must assume the execution role specified in the request; without `iam:PassRole`, the service cannot pass the role to itself, causing the API call to fail. This is a common prerequisite for any SageMaker job that requires an execution role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The sagemaker:CreateTrainingJob action is not allowed on specific resources
Why it's wrong here
The action is allowed on all resources.
- ✗
Missing s3:ListBucket permission on the bucket
Why it's wrong here
ListBucket is not required for GetObject and PutObject if the full path is known.
- ✓
Missing iam:PassRole permission
Why this is correct
SageMaker needs permission to pass the execution role to the training job.
- ✗
The training job requires permissions to write to CloudWatch Logs
Why it's wrong here
CloudWatch permissions are not included but failure is likely due to PassRole.
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.