MLS-C01 Exploratory Data Analysis Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::data-lake-bucket",
        "arn:aws:s3:::data-lake-bucket/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "athena:StartQueryExecution",
        "athena:GetQueryResults"
      ],
      "Resource": "*"
    }
  ]
}
```

A data scientist is granted the IAM policy shown in the exhibit. The data scientist can query the 'data-lake-bucket' using Athena and get results. However, when the data scientist tries to run a CTAS (CREATE TABLE AS SELECT) query in Athena to write results to a new S3 location, the query fails. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not grant s3:PutObject permission on the bucket.

The policy allows s3:GetObject and s3:ListBucket, but not s3:PutObject, which is required for CTAS queries. Option A is wrong because the policy uses resource-level permissions for S3. Option C is wrong because Athena does not require Glue Data Catalog permissions for CTAS if the table metadata is already stored. Option D is wrong because the policy does not restrict Athena resource ARNs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not grant athena:CreateTable permission.
Why it's wrong here
CTAS creates a table, but Athena uses Glue Data Catalog; however, missing Glue permissions could be an issue, but the immediate cause is S3 write permissions.
✓
The policy does not grant s3:PutObject permission on the bucket.
Why this is correct
CTAS queries write output to S3, requiring s3:PutObject.
✗
The policy does not grant permissions to the Glue Data Catalog.
Why it's wrong here
While Glue permissions may be needed, the error is likely due to missing S3 write permissions.
✗
The policy uses a wildcard for Athena actions, which is not allowed.
Why it's wrong here
Wildcards are allowed for Athena actions.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on MLS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. A data scientist is setting up an IAM policy for EDA on a data lake. The scientist needs to run exploratory SQL queries using Amazon Athena and save results to a new S3 bucket. What is a critical missing permission in this policy?

hard

A.s3:ListBucket on the output bucket
✓ B.s3:PutObject on the output S3 bucket
C.glue:GetDatabase
D.athena:StopQueryExecution

Why B: Athena writes query results to an S3 output bucket, which requires the s3:PutObject permission. Option A is incorrect because s3:ListBucket on the output bucket is not needed to write results; s3:PutObject is the necessary write permission. Option C is incorrect because glue:GetDatabase is not required for the query execution; the policy likely already includes glue:GetTable. Option D is incorrect because athena:StopQueryExecution is not directly related to saving results; the missing permission for saving results is s3:PutObject.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Timed practice sets

Short scored sets — answer, get feedback, read the explanation, move on.

MLS-C01 Practice Test 4 — 25 Questions→MLS-C01 Practice Questions 2 — 50 Questions→

Study by exam domain

Drill one exam section at a time instead of jumping between unrelated topics.

Exploratory Data Analysis Data Engineering Modeling

Filter by question format

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Go deeper on a topic

One concept per page — questions, worked explanations, and a short concept guide.

Exploratory Data Analysis practice questions Data Engineering practice questions MLS-C01 scenario practice questions Machine Learning Implementation and Operations practice questions

Where to go next

All MLS-C01 questions Exam domains MLS-C01 practice test

This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.