DEA-C01 Data Operations and Support Practice Question
A data pipeline uses AWS Glue to process data from Amazon S3 and write results to Amazon Redshift. The pipeline fails intermittently with the error 'S3ServiceException: Access Denied'. The IAM role used by Glue has permissions to read from the S3 bucket. What is the most likely cause of this error?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket policy denies access to the Glue job's IAM role
S3 bucket policies can explicitly deny access even if the IAM role allows it. Option A is wrong because S3 bucket region does not cause access denied errors. Option B is wrong because S3 Server Access Logging does not affect access permissions. Option D is wrong because S3 Transfer Acceleration is not related to access denied errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket is in a different AWS Region than the Glue job
Why it's wrong here
Cross-Region S3 access is fully supported and returns the object normally; the Access Denied error indicates a permissions or policy problem instead. It is tempting because Region mismatches do cause latency and data-transfer charges, and would matter for a bucket policy restricting access by Region condition.
- ✗
S3 Server Access Logging is enabled and blocking requests
Why it's wrong here
S3 Server Access Logging writes records to a separate target bucket and never blocks or denies requests, so it cannot produce Access Denied. It is tempting because logging is often misconfigured, and would be relevant when investigating who accessed objects, not when diagnosing permission failures.
- ✓
The S3 bucket policy denies access to the Glue job's IAM role
Why this is correct
An explicit Deny in the S3 bucket policy overrides the IAM role's Allow permissions. Even though the Glue role can read S3, the bucket policy denying that role causes the intermittent Access Denied error described in the stem.
- ✗
The S3 bucket has S3 Transfer Acceleration enabled
Why it's wrong here
Transfer Acceleration only changes the endpoint used for uploads and downloads; it does not grant or deny S3 permissions, so it cannot produce Access Denied. It is tempting because it is an S3 feature that affects access paths, but it would be relevant only when accelerating long-distance transfers, not diagnosing IAM or bucket policy denials.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.