Quick Answer
The answer is to add the `kms:Decrypt` permission for the specific KMS key to the SageMaker execution role. This is correct because when an S3 bucket is encrypted with AWS KMS, SageMaker must decrypt the data before reading it during training; without the `kms:Decrypt` action, the service receives an AccessDenied error even if `s3:GetObject` is already granted. On the AWS Certified Machine Learning Specialty MLS-C01 exam, this scenario tests your understanding of how KMS permissions interact with SageMaker’s data access layer—a common trap is assuming S3 read permissions alone suffice, but the decryption step is a separate, required authorization. Remember that KMS decryption is a distinct API call from S3 GET, so your IAM policy must explicitly allow it for the key’s ARN. A useful memory tip: “S3 gets the object, KMS unlocks the content—both permissions are non-negotiable.”
This MLS-C01 practice question tests your understanding of modeling. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A machine learning engineer is using Amazon SageMaker to train a model. The training data is stored in an S3 bucket encrypted with AWS KMS. The SageMaker training job fails with an AccessDenied error when trying to read the data. Which IAM policy addition should resolve the issue?
Add kms:Decrypt permission for the KMS key.
Decrypt is required to read encrypted objects.
Add s3:GetObject permission for the bucket.
Why wrong: S3 read permission is usually already present; the error is KMS-related.
Add kms:GenerateDataKey permission for the key.
Why wrong: GenerateDataKey is for writing, not reading.
Attach the AmazonSageMakerFullAccess policy.
Why wrong: Full access may not include KMS permissions for custom keys.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Add kms:Decrypt permission for the KMS key.
The correct answer is A because when an S3 bucket is encrypted with AWS KMS, the SageMaker training job's execution role must have the `kms:Decrypt` permission for the specific KMS key to read the encrypted objects. Without this permission, the job fails with an AccessDenied error, even if `s3:GetObject` is granted, because SageMaker must decrypt the data before reading it.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Add kms:Decrypt permission for the KMS key.
Why this is correct
Decrypt is required to read encrypted objects.
Related concept
Read the scenario before looking for a memorised answer.
Add s3:GetObject permission for the bucket.
Why it's wrong here
S3 read permission is usually already present; the error is KMS-related.
Add kms:GenerateDataKey permission for the key.
Why it's wrong here
GenerateDataKey is for writing, not reading.
Attach the AmazonSageMakerFullAccess policy.
Why it's wrong here
Full access may not include KMS permissions for custom keys.
Common exam traps
The trap here is that candidates often assume `s3:GetObject` is sufficient for reading encrypted objects, overlooking that KMS-encrypted S3 data requires explicit `kms:Decrypt` permissions on the execution role.
Detailed technical explanation
When SageMaker reads from an S3 bucket with SSE-KMS encryption, it uses the execution role's IAM policy to call the KMS `Decrypt` API with the ciphertext blob from the S3 object. The KMS key policy must also allow the role to use the key; if the key is in a different account, cross-account permissions are required. A common real-world scenario is when the KMS key is created in a separate AWS account, requiring both the key policy and the IAM role to grant `kms:Decrypt`.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Modeling — study guide chapter
Learn the concepts, then practise the questions
Modeling practice questions
Targeted practice on this topic area only
All MLS-C01 questions
1,755 questions across all exam domains
AWS Certified Machine Learning Specialty MLS-C01 study guide
Full concept coverage aligned to exam objectives
MLS-C01 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise MLS-C01 questions linked to Data Engineering.
Practise MLS-C01 questions linked to Machine Learning Implementation and Operations.
Practise MLS-C01 questions linked to Modeling.
Practise MLS-C01 questions linked to Exploratory Data Analysis.
Practise MLS-C01 questions linked to MLS-C01 fundamentals.
Practise MLS-C01 questions linked to MLS-C01 scenario.
Practise MLS-C01 questions linked to MLS-C01 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Modeling — This question tests Modeling — Read the scenario before looking for a memorised answer..
The correct answer is: Add kms:Decrypt permission for the KMS key. — The correct answer is A because when an S3 bucket is encrypted with AWS KMS, the SageMaker training job's execution role must have the `kms:Decrypt` permission for the specific KMS key to read the encrypted objects. Without this permission, the job fails with an AccessDenied error, even if `s3:GetObject` is granted, because SageMaker must decrypt the data before reading it.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 24, 2026
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.