MLS-C01 Practice Question: Machine Learning Implementation and Operations
A data scientist is using Amazon SageMaker to train a model and wants to use a custom Docker container for training. The container requires access to a private Amazon ECR repository. Which IAM role configuration is needed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to the SageMaker execution role that allows ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken for the ECR repository.
The SageMaker execution role must have an IAM policy that includes ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken for the ECR repository. This is achieved by attaching an IAM policy to the SageMaker execution role, as described in Option A. Option B is incorrect because using the AWS account owner's role is not appropriate and would grant excessive permissions. Option C is incorrect because IAM users are not used for SageMaker execution roles; roles are used instead. Option D is incorrect because bucket policies apply to S3 buckets, not ECR repositories; ECR uses resource-based policies on the repository itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach an IAM policy to the SageMaker execution role that allows ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken for the ECR repository.
Why this is correct
These permissions allow SageMaker to pull the container image.
- ✗
Use the AWS account owner's IAM role as the SageMaker execution role.
Why it's wrong here
The SageMaker execution role must have the necessary permissions; using the account owner's role is not secure.
- ✗
Create a new IAM user with ECR access and store credentials in SageMaker.
Why it's wrong here
SageMaker does not use IAM user credentials for container access.
- ✗
Add a bucket policy to the ECR repository allowing access from the SageMaker execution role.
Why it's wrong here
ECR uses resource-based policies, not bucket policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This MLS-C01 question is part of Courseiva's 1,672-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.