hardMultiple Choice
MLA-C01 Practice Question: A financial services company deploys a fraud…
A financial services company deploys a fraud detection model on a SageMaker real-time endpoint. The inference logic includes a pre-processing step that requires access to a DynamoDB table for user metadata. The model container is a custom Docker image. How should the team grant the endpoint access to DynamoDB?
⚠ Common exam trap
Test-takers frequently confuse SageMaker endpoints with EC2-based deployments and incorrectly think they need to manage instance profiles or embed credentials, when in fact SageMaker abstracts the underlying compute and uses an execution role for all API access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with DynamoDB read access and assign it to the SageMaker endpoint as the execution role
SageMaker endpoints require an IAM execution role to be assigned at creation time. This role defines the permissions the endpoint's container has when making AWS API calls, such as reading from DynamoDB. By attaching a policy with DynamoDB read access to this execution role, the endpoint securely obtains temporary credentials via the AWS STS service, eliminating the need to hardcode or manage long-term credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store IAM credentials in the container image as environment variables
Why it's wrong here
Baking IAM credentials into the image exposes long-lived keys to anyone pulling the container and cannot rotate safely. It is tempting because environment variables are the quickest way to inject configuration into a custom Docker image, but static credentials are precisely what an attached SageMaker execution role with temporary, rotated credentials replaces.
- ✗
Attach an IAM instance profile to the underlying EC2 instance
Why it's wrong here
SageMaker endpoints run as managed containers, not EC2 instances you control, so no instance profile exists to attach; the container's AWS calls come from the execution role. Instance profiles are the mechanism for granting EC2-hosted workloads DynamoDB access, which is why the option looks plausible.
- ✓
Create an IAM role with DynamoDB read access and assign it to the SageMaker endpoint as the execution role
Why this is correct
The endpoint's execution role is the identity SageMaker assumes when running the container, so attaching DynamoDB read permissions to that role lets the custom inference code call DynamoDB during pre-processing. This satisfies the requirement without embedding credentials in the image.
- ✗
Retrieve temporary credentials from AWS Secrets Manager within the container code
Why it's wrong here
Secrets Manager stores secrets, not IAM role credentials for AWS service calls; retrieving temporary credentials there adds custom rotation logic and still requires an identity to call it. It is tempting because Secrets Manager suits database passwords and API keys, but DynamoDB access needs an IAM execution role attached to the endpoint.
Go deeper
Related to this question
About these practice questions
One of 665 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.