MLS-C01 Practice Question: Machine Learning Implementation and Operations
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob",
"sagemaker:DescribeTrainingJob"
],
"Resource": "*"
}
]
}An IAM policy is attached to a SageMaker notebook instance. The data scientist wants to use the notebook to train a model using data from S3 bucket 'my-bucket'. However, the training job fails with an access denied error. What is the MOST likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on S3 permissions (s3:GetObject) or SageMaker action permissions, overlooking the IAM pass-role mechanism that is required for the notebook to delegate permissions to the training job.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The notebook instance role does not have iam:PassRole permission to pass the SageMaker execution role
The most likely cause is that the notebook instance role lacks the iam:PassRole permission, which is required to pass the SageMaker execution role to the training job. When a SageMaker notebook instance creates a training job, it must pass an execution role that the training job will assume to access resources like S3. Without iam:PassRole on the notebook's role, the API call fails with an access denied error, even if all other permissions are correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The notebook instance role does not have iam:PassRole permission to pass the SageMaker execution role
Why this is correct
SageMaker needs the notebook role to pass an execution role to training jobs.
- ✗
The sagemaker:CreateTrainingJob permission is not allowed on the specific resource
Why it's wrong here
The policy allows sagemaker:* on all resources.
- ✗
The S3 bucket resource ARN is incorrectly formatted
Why it's wrong here
The ARN is correctly formatted for objects in the bucket.
- ✗
The s3:GetObject permission is missing for the bucket
Why it's wrong here
The policy includes s3:GetObject for the bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IAM policy attached to a SageMaker notebook role is shown in the exhibit. A data scientist is trying to run a training job from the notebook, but the job fails with an access denied error. The training job needs to read data from 'my-bucket' and write output to 'my-bucket'. What is the most likely cause of the failure?
medium- A.The policy does not allow s3:ListBucket
- ✓ B.The training job execution role does not have the same permissions
- C.The policy does not allow sagemaker:CreateTrainingJob
- D.The S3 bucket is not specified in the Resource
- E.The policy does not allow s3:GetObject
Why B: The IAM policy shown is attached to the SageMaker notebook role, which is used by the data scientist to interact with the notebook. However, when a training job is launched, it runs under a separate execution role (the SageMaker execution role for training jobs), not the notebook role. The training job fails because that execution role lacks the necessary S3 permissions (e.g., s3:GetObject, s3:PutObject) to read from and write to 'my-bucket'. The notebook role's permissions are irrelevant to the training job's runtime actions.
Variation 2. A data scientist has this IAM policy attached to their IAM role. They are trying to run a SageMaker training job that reads data from 'my-bucket' and writes output to 'my-bucket'. The job fails. What is the most likely reason?
medium- A.The sagemaker:CreateTrainingJob action is not allowed on specific resources
- B.Missing s3:ListBucket permission on the bucket
- ✓ C.Missing iam:PassRole permission
- D.The training job requires permissions to write to CloudWatch Logs
Why C: The most likely reason the SageMaker training job fails is that the IAM role lacks the `iam:PassRole` permission. When SageMaker creates a training job, it must assume the execution role specified in the request; without `iam:PassRole`, the service cannot pass the role to itself, causing the API call to fail. This is a common prerequisite for any SageMaker job that requires an execution role.
Variation 3. An IAM policy attached to a SageMaker execution role is shown in the exhibit. When a data scientist tries to create a training job that writes logs to CloudWatch Logs, the job fails. What is the MOST likely reason?
medium- A.The policy does not specify the SageMaker API version
- B.The S3 bucket policy denies access to the training job
- ✓ C.The policy lacks permissions for CloudWatch Logs actions
- D.The policy has an implicit deny for SageMaker actions
Why C: The IAM policy attached to the SageMaker execution role does not include permissions for CloudWatch Logs actions (e.g., CreateLogGroup, CreateLogStream, PutLogEvents), which are required to write logs during training job execution. Option A is incorrect because the API version is not relevant to permission issues. Option B is incorrect because the problem is not related to S3 bucket policy; the training job fails due to logging, not data access. Option D is incorrect because the policy does not contain an explicit deny for SageMaker actions, but the lack of CloudWatch Logs permissions causes the failure.
Variation 4. Refer to the exhibit. An IAM policy is attached to an IAM role used by a SageMaker training job. The training job fails with an access denied error when trying to write model artifacts to an S3 bucket. What is the most likely cause?
medium- ✓ A.The IAM role does not have permission to write to the S3 bucket
- B.The training job is trying to write to a different S3 bucket
- C.The IAM role does not have permission to read the training data
- D.The IAM role does not have permission to create training jobs
Why A: The IAM role attached to the SageMaker training job must have an IAM policy that grants s3:PutObject permission on the S3 bucket where model artifacts are written. The access denied error indicates that the role lacks the necessary write permissions for that specific bucket, causing the training job to fail when it attempts to upload the model output.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.