MLA-C01 Practice Question: An ML engineer runs the CLI command shown in the…

Exhibit

Refer to the exhibit.

aws sagemaker create-training-job \
    --training-job-name my-training-job \
    --algorithm-specification 'TrainingImage=123456789012.dkr.ecr.us-west-2.amazonaws.com/my-custom-training:latest,TrainingInputMode=File' \
    --role-arn arn:aws:iam::123456789012:role/SageMakerExecutionRole \
    --input-data-config '[{"ChannelName":"train","DataSource":{"S3DataSource":{"S3Uri":"s3://my-bucket/train/","S3DataType":"S3Prefix"}},"ContentType":"text/csv"}]' \
    --output-data-config '{"S3OutputPath":"s3://my-bucket/output/"}' \
    --resource-config '{"InstanceType":"ml.m5.large","InstanceCount":1,"VolumeSizeInGB":30}' \
    --vpc-config '{"SecurityGroupIds":["sg-12345678"],"Subnets":["subnet-12345678"]}'

An ML engineer runs the CLI command shown in the exhibit. However, the training job fails immediately with an error: 'Unable to assume role'. What is the most likely cause?

⚠ Common exam trap

AWS often tests the distinction between IAM role permissions (what the role can do) and trust policies (who can assume the role), leading candidates to mistakenly select a permission-related option when the error is about trust.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM role's trust policy does not grant SageMaker permission to assume the role.

The 'Unable to assume role' error indicates that SageMaker cannot assume the IAM role specified in the CLI command. This is a trust policy issue: the role's trust policy must include SageMaker as a trusted service (i.e., `"Service": "sagemaker.amazonaws.com"`). Without this, SageMaker is not authorized to assume the role, regardless of the role's permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The IAM role 'SageMakerExecutionRole' does not have permission to create the training job.
Why it's wrong here
The error is about assuming the role, not permissions using it.
✗
The training image in ECR does not exist.
Why it's wrong here
Image existence is checked later; the immediate error is role assumption.
✗
The S3 bucket 'my-bucket' does not exist.
Why it's wrong here
If the bucket didn't exist, the error would be later, not an immediate role failure.
✓
The IAM role's trust policy does not grant SageMaker permission to assume the role.
Why this is correct
Without proper trust policy, SageMaker cannot assume the role, causing immediate failure.

Go deeper

MLA-C01 Practice Question: An ML engineer runs the CLI command shown in the…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question