MLS-C01 Modeling Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sagemaker:CreateTrainingJob",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/training/*"
}
]
}
```A data scientist is trying to create a SageMaker training job but receives an access denied error. The IAM policy attached to the role is shown in the exhibit. What is the most likely cause of the error?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not allow s3:PutObject for the output location
The IAM policy attached to the role must include the s3:PutObject action to allow SageMaker to write the training output to the specified S3 bucket. Without this permission, the training job fails with an access denied error. Option B is incorrect because the policy likely includes sagemaker:CreateTrainingJob permission, which is necessary to start the job. Option C is incorrect because there is no explicit deny statement in the policy. Option D is incorrect because the training job needs to write output, not read from the output bucket; s3:GetObject is not required for the output location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy does not allow s3:PutObject for the output location
Why this is correct
Correct. The policy lacks s3:PutObject permission on the output bucket, which is required for SageMaker to save the training output.
- ✗
The policy does not allow sagemaker:CreateTrainingJob
Why it's wrong here
Incorrect. The policy does include sagemaker:CreateTrainingJob permission, which allows the creation of training jobs.
- ✗
The policy has an explicit deny on s3:PutObject
Why it's wrong here
Incorrect. There is no explicit deny statement. The error is due to missing permissions, not an explicit deny.
- ✗
The policy does not allow s3:GetObject on the output bucket
Why it's wrong here
Incorrect. The training job writes output to the S3 bucket, so s3:PutObject is needed, not s3:GetObject.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.