DEA-C01 Data Operations and Support Practice Question
Exhibit
Refer to the exhibit.
```
[
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::example-bucket",
"arn:aws:s3:::example-bucket/*"
]
}
]
```Refer to the exhibit. A data engineer is troubleshooting an IAM policy attached to a user who cannot list objects in the S3 bucket 'example-bucket'. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy explicitly denies access to the user.
The IAM policy shown in the exhibit grants s3:ListBucket on the bucket and s3:GetObject on objects, which should allow listing. However, if the user still cannot list objects, the most likely reason is that a bucket policy explicitly denies access to that user. Bucket policies are evaluated separately from IAM policies, and an explicit deny in a bucket policy overrides any allow. Options B, C, and D are incorrect because the IAM policy in the exhibit includes the correct resource ARN (arn:aws:s3:::example-bucket for the bucket and arn:aws:s3:::example-bucket/* for objects), includes s3:ListBucket action, and does not require s3:GetObject for listing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The bucket policy explicitly denies access to the user.
Why this is correct
An explicit deny overrides the IAM policy.
- ✗
The resource ARN for the bucket is incorrect; it should be 'arn:aws:s3:::example-bucket/*'.
Why it's wrong here
The bucket ARN is correct for bucket-level operations.
- ✗
The policy includes s3:GetObject but not s3:ListObjects.
Why it's wrong here
s3:ListBucket is the correct action for listing objects.
- ✗
The policy does not include the s3:ListBucket action.
Why it's wrong here
The policy includes s3:ListBucket and s3:GetObject.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.