MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyEndpoint:
    Type: AWS::SageMaker::Endpoint
    Properties:
      EndpointName: my-endpoint
      EndpointConfigName: !Ref MyEndpointConfig
  MyEndpointConfig:
    Type: AWS::SageMaker::EndpointConfig
    Properties:
      ProductionVariants:
        - InitialInstanceCount: 2
          InstanceType: ml.m5.large
          ModelName: !Ref MyModel
          VariantName: variant-1
  MyModel:
    Type: AWS::SageMaker::Model
    Properties:
      PrimaryContainer:
        Image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image:latest
        ModelDataUrl: s3://my-bucket/model.tar.gz
      ExecutionRoleArn: arn:aws:iam::123456789012:role/SageMakerRole

Refer to the exhibit. An ML engineer creates a CloudFormation stack with this template. The stack creation succeeds, but when the engineer tries to invoke the endpoint, it returns a ModelError. The CloudWatch logs show that the container exited with error. What is the MOST likely cause?

⚠ Common exam trap

Candidates often assume a ModelError is always due to model artifacts or code issues, but in CloudFormation deployments, the most frequent cause is missing ECR permissions for the execution role, especially when the image is in a different account or the role is not explicitly granted pull access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The execution role does not have permissions to pull the Docker image from ECR.

The CloudFormation template likely does not grant the SageMaker execution role the necessary `ecr:GetDownloadUrlForLayer` and `ecr:BatchGetImage` permissions to pull the container image from Amazon ECR. Without these permissions, the SageMaker service cannot download the Docker image to the ML compute instances, causing the container to fail with a ModelError and exit error in CloudWatch logs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The execution role does not have permissions to pull the Docker image from ECR.
Why this is correct
The role must have ECR permissions to pull the image; if missing, the container fails to start.
✗
The initial instance count is set to 2, which is insufficient for the model size.
Why it's wrong here
Instance count does not cause container errors; it affects throughput.
✗
The endpoint is not deployed in a VPC and cannot access the S3 bucket.
Why it's wrong here
S3 is accessible from outside VPC; no VPC needed for S3 access.
✗
The EndpointConfig references the model but the model is not yet created.
Why it's wrong here
CloudFormation creates resources in order; model is created before endpoint config.

Go deeper

MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question