MLS-C01 Practice Question: Machine Learning Implementation and Operations
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob",
"sagemaker:CreateModel",
"sagemaker:CreateEndpointConfig",
"sagemaker:CreateEndpoint"
],
"Resource": "*"
}
]
}Refer to the exhibit. A company is using an IAM role with the attached policy to deploy a SageMaker model. The data scientist can create training jobs and models, but when trying to create an endpoint, they receive an access denied error. What is the missing permission?
⚠ Common exam trap
Watch out — candidates often confuse the permissions needed for training jobs (which often require iam:PassRole) with those needed for endpoints, overlooking the VPC networking requirement that is specific to endpoint creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ec2:CreateNetworkInterface
When SageMaker creates an endpoint, it provisions a network interface in the customer's VPC to route traffic to the endpoint instances. The IAM role must have the ec2:CreateNetworkInterface permission to allow SageMaker to create this ENI; without it, the endpoint creation fails with an access denied error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
cloudwatch:PutMetricData
Why it's wrong here
Not required for endpoint creation.
- ✗
iam:PassRole
Why it's wrong here
PassRole is needed for the execution role, but the error is specifically on creating endpoint.
- ✓
ec2:CreateNetworkInterface
Why this is correct
SageMaker creates an ENI in the VPC for the endpoint.
- ✗
sagemaker:InvokeEndpoint
Why it's wrong here
InvokeEndpoint is for calling the endpoint, not creating.
- ✗
kms:Decrypt
Why it's wrong here
Not needed unless using encrypted data.
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.