MLA-C01 Practice Question: Refer to the exhibit

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sagemaker:InvokeEndpoint",
      "Resource": "arn:aws:sagemaker:us-east-1:123456789012:endpoint/my-endpoint",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to a user to allow invoking a SageMaker endpoint. A developer tries to call the endpoint from a laptop with IP 203.0.113.5 and receives an access denied error. What is the most likely reason?

⚠ Common exam trap

The trap here is that candidates may overlook the condition element and assume the error is due to a missing action or incorrect ARN, when in fact the condition is the restrictive factor that denies access based on the source IP.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition restricts the IP address to the 10.0.0.0/8 range.

The policy includes a condition that restricts the source IP address to the 10.0.0.0/8 private range. The developer's laptop has a public IP of 203.0.113.5, which does not fall within that range, so the condition fails and access is denied. This is the most likely reason for the error because the condition explicitly blocks requests from outside the specified private network.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN is incorrect.
Why it's wrong here
The ARN appears correctly formatted.
✓
The condition restricts the IP address to the 10.0.0.0/8 range.
Why this is correct
The condition enforces that source IP must be in 10.0.0.0/8, but the laptop IP is not.
✗
The user does not have permission to assume the SageMaker role.
Why it's wrong here
The policy is attached directly to the user, no role assumption is needed.
✗
The policy does not include access to the API action.
Why it's wrong here
The policy does include sagemaker:InvokeEndpoint.

Go deeper

MLA-C01 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question