MLS-C01 Modeling Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateEndpoint"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:InvokeEndpoint"
      ],
      "Resource": "arn:aws:sagemaker:us-east-1:123456789012:endpoint/my-endpoint"
    }
  ]
}
```

Refer to the exhibit. An IAM policy is attached to a SageMaker notebook instance. A data scientist is trying to invoke the endpoint 'my-endpoint' from the notebook but receives an AccessDenied error. What is the likely cause?

⚠ Common exam trap

AWS often tests the distinction between having a policy defined versus having it attached to the correct IAM role; candidates mistakenly assume that if a policy exists in the account, it automatically applies to all resources, but IAM policies must be explicitly attached to the role or user making the request.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is not attached to the IAM role used by the notebook instance.

The error 'AccessDenied' when invoking a SageMaker endpoint from a notebook instance typically indicates that the IAM role attached to the notebook does not have the required permissions. The policy shown in the exhibit grants sagemaker:InvokeEndpoint for the specific endpoint ARN, but if the policy is not attached to the IAM role that the notebook instance is using, the role lacks the permission, resulting in the AccessDenied error. Attaching the policy to the correct IAM role resolves the issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy allows InvokeEndpoint only for endpoints with the exact ARN, but the endpoint ARN is different.
Why it's wrong here
If the ARN is correct, this would work.
✗
The policy uses a wildcard for CreateEndpoint, which is too permissive.
Why it's wrong here
That is allowed but not the cause of the error.
✗
The policy does not allow sagemaker:CreateEndpoint for the specific endpoint.
Why it's wrong here
CreateEndpoint is not needed for invocation.
✓
The policy is not attached to the IAM role used by the notebook instance.
Why this is correct
Without the policy, InvokeEndpoint is denied.

Visual reference

Go deeper

MLS-C01 Modeling Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question