MLS-C01 Exploratory Data Analysis Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket/*",
        "arn:aws:s3:::my-bucket"
      ]
    }
  ]
}

Refer to the exhibit. A data scientist is unable to read a CSV file from the S3 bucket 'my-bucket' using SageMaker. The IAM policy attached to the SageMaker execution role is shown. What is the most likely cause of the failure?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The bucket uses server-side encryption with AWS KMS (SSE-KMS) and the policy lacks kms:Decrypt permission

The policy includes s3:GetObject and s3:ListBucket, so it allows reading objects. However, if the S3 bucket uses server-side encryption with AWS KMS (SSE-KMS), the SageMaker execution role must also have the kms:Decrypt permission to decrypt the object. Without this permission, the read operation fails even though the S3 permissions are correct. Therefore, the most likely cause is that the bucket uses SSE-KMS and the policy lacks kms:Decrypt, making option C correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the s3:GetObject action
Why it's wrong here
The policy includes s3:GetObject.
✗
The policy does not grant read access to the bucket
Why it's wrong here
The policy grants GetObject, which is read access.
✓
The bucket uses server-side encryption with AWS KMS (SSE-KMS) and the policy lacks kms:Decrypt permission
Why this is correct
KMS-encrypted objects require kms:Decrypt permission.
✗
The policy does not include s3:ListBucket action
Why it's wrong here
The policy includes s3:ListBucket.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Scored practice sessions

Short scored sets — answer, get feedback, read the explanation, move on.

MLS-C01 Practice Test 2 — 25 Questions→MLS-C01 Exam Simulation 1 — 100 Questions→

Study by exam domain

Drill one exam section at a time instead of jumping between unrelated topics.

Exploratory Data Analysis Data Engineering Machine Learning Implementation and Operations

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Topic-level practice

One concept per page — questions, worked explanations, and a short concept guide.

Exploratory Data Analysis practice questions Data Engineering practice questions MLS-C01 troubleshooting practice questions Machine Learning Implementation and Operations practice questions

Keep going

All MLS-C01 questions All Amazon Web Services practice questions MLS-C01 practice test

This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.

MLS-C01 Exploratory Data Analysis Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question