MLA-C01 Practice Question: An ML engineer runs the CLI command shown in the…

Exhibit

Refer to the exhibit.

aws sagemaker create-training-job \
    --training-job-name my-training-job \
    --algorithm-specification 'TrainingImage=123456789012.dkr.ecr.us-west-2.amazonaws.com/my-custom-training:latest,TrainingInputMode=File' \
    --role-arn arn:aws:iam::123456789012:role/SageMakerExecutionRole \
    --input-data-config '[{"ChannelName":"train","DataSource":{"S3DataSource":{"S3Uri":"s3://my-bucket/train/","S3DataType":"S3Prefix"}},"ContentType":"text/csv"}]' \
    --output-data-config '{"S3OutputPath":"s3://my-bucket/output/"}' \
    --resource-config '{"InstanceType":"ml.m5.large","InstanceCount":1,"VolumeSizeInGB":30}' \
    --vpc-config '{"SecurityGroupIds":["sg-12345678"],"Subnets":["subnet-12345678"]}'

An ML engineer runs the CLI command shown in the exhibit. However, the training job fails immediately with an error: 'Unable to assume role'. What is the most likely cause?

⚠ Common exam trap

AWS often tests the distinction between IAM role permissions (what the role can do) and trust policies (who can assume the role), leading candidates to mistakenly select a permission-related option when the error is about trust.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM role's trust policy does not grant SageMaker permission to assume the role.

The 'Unable to assume role' error indicates that SageMaker cannot assume the IAM role specified in the CLI command. This is a trust policy issue: the role's trust policy must include SageMaker as a trusted service (i.e., `"Service": "sagemaker.amazonaws.com"`). Without this, SageMaker is not authorized to assume the role, regardless of the role's permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The IAM role 'SageMakerExecutionRole' does not have permission to create the training job.
Why it's wrong here
The role's own permissions govern what it can do after assumption; the 'Unable to assume role' error occurs earlier, when the caller's identity lacks sts:AssumeRole on that role or the trust policy rejects it. It is tempting because missing permissions are a frequent cause of failures, but the failing action is assumption, not job creation.
✗
The training image in ECR does not exist.
Why it's wrong here
A missing ECR image would produce an image-pull or resource-not-found error after the role is assumed and the job is provisioned. It is tempting because container images are a common misconfiguration, but the 'Unable to assume role' message indicates failure at the earlier credential-assumption step.
✗
The S3 bucket 'my-bucket' does not exist.
Why it's wrong here
A missing S3 bucket would surface later as an input-data or validation error once the job starts, not as an immediate 'Unable to assume role' failure at submission. It is tempting because S3 access is commonly misconfigured, but the error names role assumption, which occurs before any bucket is read.
✓
The IAM role's trust policy does not grant SageMaker permission to assume the role.
Why this is correct
SageMaker assumes the execution role via AWS Security Token Service, so the role's trust policy must list sagemaker.amazonaws.com as a principal. Without that sts:AssumeRole grant, the training job cannot obtain temporary credentials and fails immediately with 'Unable to assume role'.

Go deeper

MLA-C01 Practice Question: An ML engineer runs the CLI command shown in the…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question