DEA-C01 IAM policy Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "10.0.0.0/8"
}
}
}
]
}An IAM policy is attached to an IAM role used by an EC2 instance in the 10.0.0.0/8 VPC. The EC2 instance cannot read objects from the S3 bucket. What is the most likely cause?
⚠ Common exam trap
A common trap is to assume that IAM policies alone are sufficient for S3 access, but bucket policies can override them with explicit denies or by not granting access to the role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.
The most likely cause is that the S3 bucket has a bucket policy that denies access or does not explicitly grant access to the IAM role. Even if the IAM policy attached to the role allows S3 actions, a bucket policy can override it with an explicit deny or by not granting access to the role. Option A is incorrect because the s3:GetObject operation does not require s3:ListBucket permission. Option C is incorrect because SSE-KMS is not mentioned and would require specific kms:Decrypt permission, but it is not the most likely cause. Option D is incorrect because the EC2 instance's private IP is within the 10.0.0.0/8 VPC range, and the public IP is irrelevant for in-VPC communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy does not grant s3:ListBucket permission.
Why it's wrong here
s3:GetObject does not require ListBucket for reading objects.
- ✓
The S3 bucket has a bucket policy that denies public access, and the IAM policy alone is insufficient.
Why this is correct
The IAM policy allows access, but if the bucket policy denies all access except from specific principals, the IAM role may still be denied. The bucket policy must explicitly allow the role.
- ✗
The bucket is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.
Why it's wrong here
The policy does not include KMS permissions, but the question does not mention encryption.
- ✗
The EC2 instance's public IP is not in the 10.0.0.0/8 range.
Why it's wrong here
EC2 instances in a VPC use private IPs, which are in that range, so this condition should be satisfied.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user who cannot list objects in the S3 bucket 'example-bucket'. What is the most likely reason?
easy- ✓ A.The bucket policy explicitly denies access to the user.
- B.The resource ARN for the bucket is incorrect; it should be 'arn:aws:s3:::example-bucket/*'.
- C.The policy includes s3:GetObject but not s3:ListObjects.
- D.The policy does not include the s3:ListBucket action.
Why A: The IAM policy shown in the exhibit grants s3:ListBucket on the bucket and s3:GetObject on objects, which should allow listing. However, if the user still cannot list objects, the most likely reason is that a bucket policy explicitly denies access to that user. Bucket policies are evaluated separately from IAM policies, and an explicit deny in a bucket policy overrides any allow. Options B, C, and D are incorrect because the IAM policy in the exhibit includes the correct resource ARN (arn:aws:s3:::example-bucket for the bucket and arn:aws:s3:::example-bucket/* for objects), includes s3:ListBucket action, and does not require s3:GetObject for listing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.