hardMultiple ChoiceObjective-mapped
MLA-C01 Practice Question: A financial services company deploys a fraud…
A financial services company deploys a fraud detection model on a SageMaker real-time endpoint. The inference logic includes a pre-processing step that requires access to a DynamoDB table for user metadata. The model container is a custom Docker image. How should the team grant the endpoint access to DynamoDB?
⚠ Common exam trap
Test-takers frequently confuse SageMaker endpoints with EC2-based deployments and incorrectly think they need to manage instance profiles or embed credentials, when in fact SageMaker abstracts the underlying compute and uses an execution role for all API access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with DynamoDB read access and assign it to the SageMaker endpoint as the execution role
SageMaker endpoints require an IAM execution role to be assigned at creation time. This role defines the permissions the endpoint's container has when making AWS API calls, such as reading from DynamoDB. By attaching a policy with DynamoDB read access to this execution role, the endpoint securely obtains temporary credentials via the AWS STS service, eliminating the need to hardcode or manage long-term credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store IAM credentials in the container image as environment variables
Why it's wrong here
Hardcoding credentials is insecure and violates best practices.
- ✗
Attach an IAM instance profile to the underlying EC2 instance
Why it's wrong here
SageMaker endpoints are managed services; you don't attach instance profiles directly.
- ✓
Create an IAM role with DynamoDB read access and assign it to the SageMaker endpoint as the execution role
Why this is correct
SageMaker assumes the execution role to access other AWS services.
- ✗
Retrieve temporary credentials from AWS Secrets Manager within the container code
Why it's wrong here
Secrets Manager is for secrets, but SageMaker can use execution role directly.
Go deeper
Related to this question
About these practice questions
One of 835 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.