ExamPark
Course menuMLA-C02

Exams / MLA-C02 / IAM and least privilege for ML / Question 1

MLA-C02 practice question: IAM and least privilege for ML (1 of 2)

Operating, Monitoring, and Securing ML and AI Solutions A free question from our original MLA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A regional bank's SageMaker AI training job fails after a few minutes with an AccessDenied error when it writes model output to an S3 bucket. The bucket's default encryption uses a customer managed AWS KMS key, and the job's execution role was created with access to the bucket.

The team wants to fix the failure with the least broad permissions, keeping the execution role limited to what the job needs.

Which change should the team make?

Choose one answer.

  1. A. Grant the execution role the KMS actions it needs on the customer managed key, and let the key policy trust the role.
  2. B. Attach the AdministratorAccess managed policy to the execution role, so that every action the job takes is allowed.
  3. C. Make the S3 bucket public for writes, since public access removes any need for a role to be authorized.
  4. D. Change the bucket to use SSE-S3 encryption, which needs no KMS key permissions, so that the role can write to it again.
Show the answer and explanation

Answer: A

  • A. Right: Correct. Writing objects to a bucket that uses SSE-KMS requires KMS permissions, such as kms:GenerateDataKey, on the customer managed key, and the key policy must allow the role. Adding only those actions on that key keeps the role narrow. Learn more: Protecting data using server-side encryption with KMS keys (opens in a new tab)
  • B. Wrong: Administrator access grants far more than the job needs and fails the least-privilege requirement. The stem asks for the narrowest fix.
  • C. Wrong: Public write access is a serious security risk and does not follow least privilege. The option also removes the controls the bank requires.
  • D. Wrong: SSE-S3 needs no KMS permissions, but the bank's policy requires its customer managed key on this bucket. Switching encryption to meet the error would break that requirement.

Explanation

A bucket whose default encryption uses a customer managed KMS key requires the writer to have KMS permissions on that key, and the key policy must allow the role. Adding only those actions fixes the AccessDenied with least privilege. Administrator access, public writes and changing the bucket's encryption are broader or break the bank's policy.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free MLA-C02 practice examPractice IAM and least privilege for MLAll IAM and least privilege for ML questions

Want more on IAM and least privilege for ML? The 5 full-length practice sets have 10 more IAM and least privilege for ML questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets