MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateModel",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateEndpoint",
        "sagemaker:InvokeEndpoint"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::123456789012:role/SageMakerExecutionRole",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "sagemaker.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "sagemaker:DeleteEndpoint",
        "sagemaker:DeleteEndpointConfig",
        "sagemaker:DeleteModel"
      ],
      "Resource": "*"
    }
  ]
}

An ML engineer is troubleshooting why an automated CI/CD pipeline cannot deploy an updated model to an existing SageMaker endpoint. The pipeline uses the IAM role that has the attached policy shown in the exhibit. What is the MOST likely cause of the failure?

⚠ Common exam trap

Candidates often confuse the actions required for updating an existing endpoint (UpdateEndpoint) with those for creating a new one (CreateEndpoint), leading them to incorrectly select Option B when the pipeline is actually performing an update.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The pipeline tries to update an existing endpoint, but the sagemaker:UpdateEndpoint action is not allowed.

The pipeline is attempting to deploy an updated model to an existing SageMaker endpoint, which requires the sagemaker:UpdateEndpoint action. The IAM policy shown in the exhibit (not provided here but implied) does not include this action, so the API call fails with an access denied error. Without explicit permission to update the endpoint, the CI/CD pipeline cannot modify the deployed configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The pipeline tries to update an existing endpoint, but the sagemaker:UpdateEndpoint action is not allowed.
Why this is correct
The policy does not include sagemaker:UpdateEndpoint, which is required to update an existing endpoint. Without this permission, the update fails.
✗
The pipeline tries to create a new endpoint, but the sagemaker:CreateEndpoint action is denied.
Why it's wrong here
The policy allows sagemaker:CreateEndpoint, so creation is permitted. The issue is with updating an existing endpoint.
✗
The pipeline tries to delete the old endpoint, but the sagemaker:DeleteEndpoint action is denied by a Deny statement.
Why it's wrong here
The Deny statement blocks Delete actions, but the pipeline is trying to update, not delete. The lack of Update permission is the issue.
✗
The pipeline attempts to invoke the endpoint, but the sagemaker:InvokeEndpoint action is denied.
Why it's wrong here
The policy allows sagemaker:InvokeEndpoint, so invocation is not the issue.

Go deeper

MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question