MLS-C01 Modeling Practice Question
A data scientist is using SageMaker to train a model that requires access to a private S3 bucket in another account. The scientist has set up the correct IAM roles and bucket policies. However, the training job fails with an access denied error. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume 'access denied' always means an IAM or bucket policy issue, but in cross-account scenarios with VPCs, network misconfigurations (like missing VPC endpoints) are a common hidden cause that produces the same error message.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC used for training does not have a route to S3 (e.g., missing VPC endpoint or NAT)
When a SageMaker training job runs inside a VPC (which is common for cross-account access), the VPC must have a route to S3, either through a VPC endpoint (Gateway or Interface) or a NAT gateway. Without such a route, the training instances cannot reach the private S3 bucket in the other account, even if IAM roles and bucket policies are correctly configured, resulting in an 'access denied' error because the network path is blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SageMaker execution role does not have s3:GetObject permission
Why it's wrong here
This is possible but the question states IAM roles and bucket policies are set up correctly.
- ✗
The S3 objects are encrypted with SSE-KMS and the KMS key is not accessible
Why it's wrong here
This would cause an access denied error but the question states roles and policies are correct; KMS permissions might be separate.
- ✗
The training instance type does not support S3 access
Why it's wrong here
All SageMaker instance types can access S3 given proper networking.
- ✓
The VPC used for training does not have a route to S3 (e.g., missing VPC endpoint or NAT)
Why this is correct
If training is in a VPC without S3 access, the job cannot reach S3 despite correct IAM policies.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.