MLS-C01 Modeling Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateTrainingJob",
        "sagemaker:DescribeTrainingJob",
        "sagemaker:StopTrainingJob"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}
```

A data scientist is trying to launch a SageMaker training job using an IAM role with the above policy. The training job fails with an access denied error. What is the MOST likely reason?

⚠ Common exam trap

AWS often tests the subtle distinction between bucket-level actions (s3:ListBucket) and object-level actions (s3:GetObject, s3:PutObject), where candidates mistakenly assume object permissions are sufficient for SageMaker training jobs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not include s3:ListBucket permission

The policy grants s3:GetObject and s3:PutObject permissions on the S3 bucket ARN with a /* suffix, but SageMaker training jobs also require s3:ListBucket permission at the bucket level (without the /*) to enumerate objects and validate paths during job creation. Without s3:ListBucket, the training job fails with an access denied error even though read/write permissions are present.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy does not include s3:ListBucket permission
Why this is correct
SageMaker needs ListBucket to access objects in the bucket.
✗
The sagemaker:StopTrainingJob action is not required
Why it's wrong here
Extra actions are fine.
✗
The sagemaker:CreateTrainingJob action is not allowed for the specific instance type
Why it's wrong here
The policy allows all SageMaker training actions.
✗
The S3 bucket ARN should not include the /* suffix
Why it's wrong here
The /* suffix is correct for object-level permissions.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLS-C01 Modeling Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question