MLS-C01 IAM Permissions for Athena Practice Question
Network Topology
Refer to the exhibit. A data engineer runs an Athena query and gets a failure. What is the most likely cause?
⚠ Common exam trap
Candidates often assume that the bucket must be new or empty, but Athena can use any existing bucket. The real trap is forgetting that the IAM role must have write permissions to the output bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role used does not have permissions to write to S3.
The most likely cause for an Athena query failure is that the IAM role used does not have the necessary permissions to write query results to the specified S3 bucket. While syntax errors or encryption settings can cause issues, permissions are a frequent and common cause of failure in practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The query result location uses a bucket with default encryption enabled.
Why it's wrong here
Default encryption on the output bucket is not a common cause of failure; Athena can write to encrypted buckets as long as the role has appropriate decrypt permissions.
- ✗
The SQL query syntax is incorrect.
Why it's wrong here
Incorrect SQL syntax can cause a query failure, but it typically produces a syntax error message, and is less likely than a permissions issue in this general scenario.
- ✓
The IAM role used does not have permissions to write to S3.
Why this is correct
The IAM role used by Athena must have s3:PutObject permission for the output bucket. Lack of permissions is a frequent and common cause of query failures.
- ✗
The output S3 bucket specified in the query result configuration already exists.
Why it's wrong here
Athena does not require the output S3 bucket to be new or empty; it can use any existing bucket. The error described ('output bucket already exists') is not typical for Athena.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This MLS-C01 question is part of Courseiva's 1,672-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.