MLS-C01 Practice Question: Machine Learning Implementation and Operations
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateEndpoint",
"sagemaker:InvokeEndpoint"
],
"Resource": "arn:aws:sagemaker:us-east-1:123456789012:endpoint/my-endpoint"
},
{
"Effect": "Deny",
"Action": "sagemaker:InvokeEndpoint",
"Resource": "*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16"
]
}
}
}
]
}Refer to the exhibit. An ML engineer attaches this IAM policy to a user. The user wants to invoke the SageMaker endpoint my-endpoint from an EC2 instance with public IP 52.1.1.1. What will happen?
⚠ Common exam trap
AWS often tests the misconception that a Deny statement with a condition applies to all requests regardless of the condition, or that invoking an endpoint requires additional permissions like creating the endpoint, leading candidates to incorrectly choose options A or B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The invocation is allowed because the source IP is not in the denied ranges.
The IAM policy explicitly allows the `sagemaker:InvokeEndpoint` action, and the `Deny` statement only denies requests from IP addresses in the ranges 10.0.0.0/8 or 192.168.0.0/16. Since the EC2 instance has a public IP of 52.1.1.1, which is not within those denied ranges, the invocation is allowed. The policy does not require the user to be in a VPC or to have endpoint creation permissions for invoking an existing endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The invocation fails because the user does not have permission to create an endpoint.
Why it's wrong here
The user is invoking, not creating; the Allow explicitly permits InvokeEndpoint.
- ✗
The invocation is denied because the Deny statement applies to all resources.
Why it's wrong here
The Deny has a condition that is not satisfied, so it does not apply.
- ✓
The invocation is allowed because the source IP is not in the denied ranges.
Why this is correct
The Deny condition does not match the public IP, so Allow prevails.
- ✗
The invocation is denied because the user is not in a VPC.
Why it's wrong here
The policy does not require being in a VPC; the condition is about source IP.
Go deeper
Related to this question
About these practice questions
This MLS-C01 question is part of Courseiva's 1,672-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.