MLA-C01 Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreateTrainingJob",
                "sagemaker:DescribeTrainingJob",
                "sagemaker:StopTrainingJob"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-bucket/training/*"
        },
        {
            "Effect": "Deny",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::my-bucket/training/sensitive-data.csv"
        }
    ]
}
```

Refer to the exhibit. A SageMaker execution role has the IAM policy shown. The team attempts to run a training job that writes results to 's3://my-bucket/training/output/model.tar.gz'. What will happen?

⚠ Common exam trap

Test-takers frequently assume the Deny statement blocks all PutObject actions to the 'training/' directory, but they overlook that the target object's key includes a subdirectory ('output/'), so the prefix 'training/' does not match the full key path 'training/output/model.tar.gz'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The training job will succeed and write the model artifact.

The training job will succeed because the Allow statement in the IAM policy explicitly grants s3:PutObject on the specific object 's3://my-bucket/training/output/model.tar.gz', and the Deny statement only blocks PutObject on objects with a 'training/' prefix in the key. Since the target object key is 'training/output/model.tar.gz', it does not start with 'training/' (the prefix is 'training/output/'), so the Deny does not apply. The Allow is therefore effective, and the model artifact is written successfully.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The training job will fail because the Deny statement blocks all PutObject actions.
Why it's wrong here
Deny is scoped to a specific object.
✓
The training job will succeed and write the model artifact.
Why this is correct
The Deny does not affect this resource.
✗
The training job will fail because the Deny statement overrides the Allow.
Why it's wrong here
Deny overrides Allow for the specified resource only.
✗
The training job will succeed, but the output file will be encrypted with a different key.
Why it's wrong here
No encryption key implications from this policy.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLA-C01 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question