DEA-C01 Data Operations and Support Practice Question
A data engineer needs to set up a cross-account access for an S3 bucket so that users in Account B can read objects. The bucket in Account A has a bucket policy that grants access. What additional step is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in Account B and attach a policy that allows s3:GetObject for the bucket.
Cross-account S3 access requires both a bucket policy in the source account (Account A) that grants permissions to the target account or role, and an IAM role in the target account (Account B) with a policy allowing the necessary actions (e.g., s3:GetObject). This ensures that users in Account B can assume the role and access the bucket. Option A (enabling ACLs) is unnecessary and not recommended; ACLs are legacy and can be disabled. Option C (disabling Block Public Access) is not required because the bucket policy is not public; it only grants cross-account access to a specific role. Option D (lifecycle policy) is for object lifecycle management and does not provide access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 object ACLs on the bucket.
Why it's wrong here
ACLs are not required for cross-account access; bucket policies and IAM are the modern approach.
- ✓
Create an IAM role in Account B and attach a policy that allows s3:GetObject for the bucket.
Why this is correct
Users in Account B need an IAM role or user with explicit permissions to access the bucket.
- ✗
Disable S3 Block Public Access settings on the bucket.
Why it's wrong here
Block Public Access applies to public access, not cross-account access via bucket policies.
- ✗
Set up an S3 Lifecycle policy to replicate objects to Account B.
Why it's wrong here
Replication is for copying objects, not granting access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.