DEA-C01 Data Operations and Support Practice Question
A data engineer has an AWS Glue job that processes data from an Amazon S3 bucket and writes to an Amazon Redshift cluster. The job is scheduled to run daily. Recently, the job started failing with the error: 'java.sql.SQLException: [Amazon](500310) Invalid operation: Spectrum Scan Error: S3 Access Denied'. The engineer verifies that the IAM role associated with the Glue job has full access to the S3 bucket. What is the most likely cause of this error?
⚠ Common exam trap
The trap here is assuming that the Glue job's IAM role is the only one involved, but Redshift uses its own IAM role for COPY commands.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Amazon Redshift cluster's IAM role lacks permission to access the S3 bucket.
The error occurs because Amazon Redshift, not AWS Glue, is attempting to access S3 during the COPY operation. The Redshift cluster's IAM role must have permissions to read the S3 bucket. Even if the Glue job's role has access, Redshift uses its own role. The engineer should attach a policy to the Redshift cluster's IAM role granting S3 read access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Glue job's script is using an incorrect S3 path for the Redshift COPY command.
Why it's wrong here
An incorrect S3 path would result in a 'file not found' error or a different message, not 'S3 Access Denied'. The error specifically indicates a permission issue, not a path issue. If the path were wrong, the error would mention that the object does not exist.
- ✓
The Amazon Redshift cluster's IAM role lacks permission to access the S3 bucket.
Why this is correct
When AWS Glue writes to Amazon Redshift using the COPY command, Redshift itself must access the S3 bucket. If the Redshift cluster's IAM role does not have the necessary S3 permissions, Redshift cannot read the data, resulting in a Spectrum Scan Error with S3 Access Denied. The Glue job's role permissions are separate from Redshift's role.
- ✗
The Amazon Redshift cluster is in a different AWS Region than the S3 bucket, causing access latency.
Why it's wrong here
Cross-region access can cause latency or additional data transfer costs, but it does not result in an access denied error. The 'S3 Access Denied' message is a clear permission issue, not a networking or latency problem. Redshift can access S3 across regions if the permissions are correctly configured.
- ✗
The S3 bucket policy explicitly denies access to the Glue job's IAM role.
Why it's wrong here
The engineer already verified that the Glue job's IAM role has full access to the S3 bucket. If the bucket policy denied access, the error would occur when Glue reads from S3, not when Redshift tries to access it. The error mentions Spectrum Scan, which is a Redshift operation, indicating Redshift's role is the issue.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.