MLS-C01 Practice Question: Machine Learning Implementation and Operations
A data scientist is using Amazon SageMaker to train a TensorFlow model on a dataset that includes sensitive personal information (PII). The data is stored in Amazon S3 with server-side encryption using AWS KMS (SSE-KMS). The training job fails with an Access Denied error when trying to read from S3. The data scientist has already verified that the SageMaker execution role has s3:GetObject permissions on the S3 bucket. What additional configuration is needed?
⚠ Common exam trap
The trap here is that candidates often focus solely on S3 permissions and overlook the fact that SSE-KMS introduces a separate KMS authorization layer, so even with full S3 access, the role still needs explicit kms:Decrypt to read encrypted objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add kms:Decrypt permission to the SageMaker execution role.
When S3 objects are encrypted with SSE-KMS, the SageMaker execution role must have the kms:Decrypt permission to decrypt the data during training. Even though the role has s3:GetObject access, the KMS key policy or the role's IAM policy must explicitly allow decryption of the KMS key used for server-side encryption. Without this, SageMaker cannot read the encrypted objects, resulting in an Access Denied error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add kms:Decrypt permission to the SageMaker execution role.
Why this is correct
SSE-KMS requires decrypt permission to read objects.
- ✗
Add kms:Encrypt permission to the SageMaker execution role.
Why it's wrong here
Encrypt is for writing, not reading.
- ✗
Add a bucket policy that grants s3:GetObject to the SageMaker role.
Why it's wrong here
Role already has permission; bucket policy is not needed.
- ✗
Configure a VPC endpoint for S3 and attach a policy.
Why it's wrong here
VPC endpoint policy might restrict access, but the issue is KMS permissions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This MLS-C01 question is part of Courseiva's 1,672-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data scientist is using Amazon SageMaker to train a model. The training data is stored in an S3 bucket encrypted with AWS KMS. Which TWO actions are necessary to allow SageMaker to access the data?
easy- ✓ A.Ensure the SageMaker execution role has s3:GetObject permission.
- B.Enable S3 Transfer Acceleration.
- C.Set up a VPC endpoint for S3.
- D.Add a bucket policy allowing SageMaker access.
- ✓ E.Grant the SageMaker execution role kms:Decrypt permission.
Why A: A is correct because the SageMaker execution role must have the s3:GetObject permission to read objects from the S3 bucket. Without this IAM permission, SageMaker cannot retrieve the training data, even if the bucket is otherwise accessible.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.