MLS-C01 Practice Question: Machine Learning Implementation and Operations
A data scientist is using Amazon SageMaker to train a model. The training data is stored in an S3 bucket encrypted with AWS KMS. Which TWO actions are necessary to allow SageMaker to access the data?
⚠ Common exam trap
The trap here is that candidates often forget that KMS-encrypted S3 objects require both s3:GetObject and kms:Decrypt permissions, leading them to select only the S3 permission and miss the KMS permission.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the SageMaker execution role has s3:GetObject permission.
A is correct because the SageMaker execution role must have the s3:GetObject permission to read objects from the S3 bucket. Without this IAM permission, SageMaker cannot retrieve the training data, even if the bucket is otherwise accessible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure the SageMaker execution role has s3:GetObject permission.
Why this is correct
Required to read objects.
- ✗
Enable S3 Transfer Acceleration.
Why it's wrong here
Not required for access.
- ✗
Set up a VPC endpoint for S3.
Why it's wrong here
Optional, not required.
- ✗
Add a bucket policy allowing SageMaker access.
Why it's wrong here
Bucket policy is for cross-account, not needed if same account.
- ✓
Grant the SageMaker execution role kms:Decrypt permission.
Why this is correct
Required to decrypt data.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.