MLS-C01 Data Engineering Practice Question
Which TWO steps are required to set up cross-account access to an Amazon S3 data lake for AWS Glue jobs running in a different AWS account? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse network-level connectivity (VPC peering) with IAM-level authorization, or assume that cross-account Glue crawlers are a built-in feature, when in fact the crawler must be in the same account as the data lake or use an assumed role with cross-account permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy to the S3 bucket that grants access to the Glue service role from the other account.
An S3 bucket policy can grant cross-account access by specifying the AWS account ID of the second account as the principal, allowing the Glue service role from that account to read objects. This is a standard method for delegating access to S3 resources across accounts without requiring IAM roles in the source account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a bucket policy to the S3 bucket that grants access to the Glue service role from the other account.
Why this is correct
Correct: Bucket policy allows cross-account access.
- ✓
Create an IAM role in the second account that the Glue job can assume, with permissions to read from the S3 bucket.
Why this is correct
Correct: The Glue job needs a role with cross-account access.
- ✗
Create a cross-account Glue crawler in the source account.
Why it's wrong here
Incorrect: Crawlers run in the account where the data is located.
- ✗
Set up VPC peering between the two accounts' VPCs.
Why it's wrong here
Incorrect: VPC peering is not needed for S3 access.
- ✗
Ensure both accounts are in the same AWS organization.
Why it's wrong here
Incorrect: Organization is not required for cross-account access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.