MLS-C01 Modeling Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateTrainingJob",
        "sagemaker:DescribeTrainingJob"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/training/*"
    }
  ]
}

Refer to the exhibit. A data scientist is trying to run a SageMaker training job using a script that reads training data from 's3://my-bucket/training/data.csv'. The job fails with an access denied error. What is the MOST likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The S3 bucket policy may deny access, or the IAM role lacks necessary permissions beyond GetObject.

The most likely reason for the access denied error is that the S3 bucket policy may deny access, or the IAM role used by SageMaker lacks the necessary permissions beyond s3:GetObject. The script reads from a specific path, but the role might not have permissions to list the bucket or access other required objects. Option B is incorrect because the error is about access denied, not VPC endpoint configuration. Option C is incorrect because the CreateTrainingJob action is allowed. Option D is incorrect because the S3 path is correctly formatted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The S3 bucket policy may deny access, or the IAM role lacks necessary permissions beyond GetObject.
Why this is correct
Common reason: the training script may need to list the bucket or access other prefixes, or a bucket policy denies the request.
✗
The training job is running in a VPC without S3 VPC endpoint.
Why it's wrong here
No VPC configuration is mentioned in the policy.
✗
The sagemaker:CreateTrainingJob action is not allowed on the specific resource.
Why it's wrong here
The policy allows * resource for CreateTrainingJob, so that is not the issue.
✗
The S3 path is incorrectly formatted.
Why it's wrong here
The path 's3://my-bucket/training/data.csv' is valid.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLS-C01 Modeling Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question