MLA-C01 Practice Question: Refer to the exhibit

Exhibit

{
  "MonitoringScheduleName": "model-quality-monitor",
  "EndpointName": "my-endpoint",
  "MonitoringType": "DataQuality",
  "MonitoringScheduleConfig": {
    "ScheduleExpression": "cron(0 * * * ? *)",
    "MonitoringJobDefinition": {
      "BaselineConfig": {
        "BaseliningJobName": "baseline-job",
        "ConstraintsResource": {
          "S3Uri": "s3://my-bucket/baseline/constraints.json"
        },
        "StatisticsResource": {
          "S3Uri": "s3://my-bucket/baseline/statistics.json"
        }
      },
      "MonitoringInputs": [
        {
          "EndpointInput": {
            "EndpointName": "my-endpoint",
            "LocalPath": "/opt/ml/processing/input/endpoint",
            "S3DataDistributionType": "FullyReplicated",
            "S3InputMode": "File"
          }
        }
      ],
      "MonitoringOutputConfig": {
        "MonitoringOutputs": [
          {
            "S3Output": {
              "S3Uri": "s3://my-bucket/monitor-output",
              "LocalPath": "/opt/ml/processing/output",
              "S3UploadMode": "Continuous"
            }
          }
        ]
      },
      "MonitoringResources": {
        "ClusterConfig": {
          "InstanceCount": 1,
          "InstanceType": "ml.m5.large",
          "VolumeSizeInGB": 20
        }
      },
      "RoleArn": "arn:aws:iam::123456789012:role/SageMakerMonitorRole"
    }
  }
}

Refer to the exhibit. A company configures a SageMaker Model Monitor Data Quality monitoring schedule as shown. The schedule runs every hour. However, the team notices that the monitoring job fails intermittently with an AccessDenied error when accessing the S3 bucket for output. The IAM role SageMakerMonitorRole has permissions to write to s3://my-bucket/monitor-output. What is the MOST likely cause of the failure?

⚠ Common exam trap

AWS often tests the interaction between VPC networking and S3 bucket policies, where candidates overlook that a VPC without an S3 endpoint will cause AccessDenied errors even if the IAM role has full S3 permissions, because the bucket policy itself blocks non-VPC-endpoint traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The monitoring job runs in a VPC that does not have an S3 VPC endpoint, and the bucket policy denies requests from outside the VPC.

The intermittent AccessDenied error when SageMaker Model Monitor attempts to write to the S3 output bucket strongly indicates a network or policy restriction. If the monitoring job is configured to run inside a VPC (common for security compliance) and that VPC lacks an S3 VPC endpoint, traffic to S3 traverses the public internet. If the S3 bucket policy explicitly denies requests from outside the VPC (using a condition like `aws:SourceVpce` or `aws:SourceVpc`), then jobs running inside the VPC without an endpoint will be denied access intermittently, especially if the job's execution role is assumed from within the VPC.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The S3UploadMode is set to Continuous, which is only supported for batch transform jobs.
Why it's wrong here
Continuous is valid for monitoring.
✓
The monitoring job runs in a VPC that does not have an S3 VPC endpoint, and the bucket policy denies requests from outside the VPC.
Why this is correct
VPC restrictions can cause AccessDenied even if the IAM role allows.
✗
The cron expression is invalid; it should use rate(1 hour) instead.
Why it's wrong here
cron(0 * * * ? *) is valid for hourly.
✗
The baseline constraints and statistics files are missing from the S3 bucket.
Why it's wrong here
The error is AccessDenied, not missing files.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLA-C01 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question