MLS-C01 Data Engineering Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/data/*",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/MySageMakerRole"
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket",
      "Principal": "*"
    }
  ]
}

Refer to the exhibit. An ML engineer applies this bucket policy to an S3 bucket. The SageMaker execution role MySageMakerRole is used to train a model. The training data is located in s3://my-bucket/data/. The SageMaker training job fails with an access error. What is the most likely cause?

⚠ Common exam trap

Many candidates assume GetObject alone is sufficient for reading data, but SageMaker training jobs also require ListBucket to enumerate objects in the prefix, and an explicit Deny on ListBucket overrides any Allow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Deny statement on s3:ListBucket prevents the role from listing objects in the bucket.

The Deny statement on s3:ListBucket explicitly denies the s3:ListBucket action for the MySageMakerRole. SageMaker training jobs require the ability to list objects in the bucket to discover and read training data, even if the GetObject permission is granted. The explicit Deny overrides any Allow, causing the access error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy allows GetObject only from the data/ prefix, but the training job uses a different prefix.
Why it's wrong here
The stem says data is in data/ prefix.
✗
The role is not in the same AWS account as the bucket.
Why it's wrong here
The role ARN uses account 123456789012, which is the same account.
✓
The Deny statement on s3:ListBucket prevents the role from listing objects in the bucket.
Why this is correct
SageMaker may need to list objects to iterate over files; the explicit deny blocks this.
✗
The bucket has default encryption enabled, causing a conflict.
Why it's wrong here
Default encryption does not cause access errors.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLS-C01 Data Engineering Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question