MLA-C01 · Question #69
A company needs to give its ML engineers appropriate access to training data. The ML engineers must access training data from only their own business group. The ML engineers must not be allowed to acc
The correct answer is D. Create IAM policies. Attach the policies to IAM users or IAM roles.. D is correct because IAM (Identity and Access Management) policies are the standard AWS mechanism for controlling who can access which resources. By creating policies that grant access only to specific S3 buckets (scoped per business group) and attaching them to the appropriate I
Question
A company needs to give its ML engineers appropriate access to training data. The ML engineers must access training data from only their own business group. The ML engineers must not be allowed to access training data from other business groups. The company uses a single AWS account and stores all the training data in Amazon S3 buckets. All ML model training occurs in Amazon SageMaker. Which solution will provide the ML engineers with the appropriate access?
Options
- AEnable S3 bucket versioning.
- BConfigure S3 Object Lock settings for each user.
- CAdd cross-origin resource sharing (CORS) policies to the S3 buckets.
- DCreate IAM policies. Attach the policies to IAM users or IAM roles.
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C19% (5)
- D70% (19)
Explanation
D is correct because IAM (Identity and Access Management) policies are the standard AWS mechanism for controlling who can access which resources. By creating policies that grant access only to specific S3 buckets (scoped per business group) and attaching them to the appropriate IAM users or roles, you enforce fine-grained, group-level access control within a single AWS account - exactly what the scenario requires.
Why the distractors are wrong:
- A (S3 Versioning) tracks object versions over time for recovery purposes - it has nothing to do with user access control.
- B (S3 Object Lock) prevents object deletion/overwriting (WORM compliance) - it controls data mutability, not who can read or access data.
- C (CORS policies) governs cross-origin browser requests (e.g., a web app on domain A accessing S3 from domain B) - irrelevant to engineer-level access restrictions within AWS.
Memory tip: When a question involves "who can access what" in AWS, the answer almost always involves IAM. CORS = browser origins, Object Lock = immutability, Versioning = history - none of these are identity or authorization tools.
Topics
Community Discussion
No community discussion yet for this question.