MLA-C01 Deployment and Orchestration of ML Workflows Practice Question
An ML engineer has trained a model and stored the model artifacts in an Amazon S3 bucket in the same AWS Region as the planned SageMaker AI endpoint. During endpoint creation, the engineer must specify the S3 location of the model artifacts. Which permission must the SageMaker AI execution role have for the endpoint to load the model successfully?
⚠ Common exam trap
The trap here is granting broad Amazon S3 permissions such as listing all buckets instead of the specific read access the endpoint actually needs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:GetObject on the model artifact objects in the bucket.
The SageMaker AI execution role must be able to read the model artifacts from Amazon S3 when the container starts. Granting s3:GetObject on the artifact objects provides exactly that read access and follows least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
s3:PutObject on the model artifact prefix in the bucket.
Why it's wrong here
PutObject allows writing objects to Amazon S3, which is useful for batch transform output or for saving artifacts, but endpoint hosting only needs to read the existing model artifacts. Granting write access would not resolve a failure to load the model and would over-provision permissions.
- ✗
s3:DeleteObject on the model artifact prefix in the bucket.
Why it's wrong here
DeleteObject permits removing objects, which is unrelated to loading a model for hosting and would be a dangerous permission to attach to an execution role. It does not provide the read access the container requires to fetch the model artifacts.
- ✓
s3:GetObject on the model artifact objects in the bucket.
Why this is correct
The SageMaker AI execution role is assumed by the hosting infrastructure to download model artifacts from Amazon S3 at container startup. Without s3:GetObject on the specific artifact objects, the container cannot retrieve the model and endpoint creation or invocation fails, so this permission is required.
- ✗
s3:ListAllMyBuckets at the account level.
Why it's wrong here
Listing all buckets in the account does not grant access to the objects inside a specific bucket. The endpoint needs to read the model artifact objects, so this broad but irrelevant permission would not enable the container to download the model and would violate least privilege.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
One of 665 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.