DEA-C01 Data Ingestion and Transformation Practice Question
Network Topology
Refer to the exhibit. A data engineer runs an AWS Glue job that fails with an 'Access Denied' error when writing to S3. The IAM role attached to the job has s3:PutObject permission on the output bucket. What additional configuration is most likely missing?
⚠ Common exam trap
The DEA-C01 exam often tests the misconception that IAM permissions alone are sufficient for S3 access, ignoring that bucket policies (resource-based policies) are a separate authorization layer that must also grant the action, especially in cross-account or service-specific contexts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket policy does not grant access to the Glue job's IAM role
The IAM role attached to the Glue job has s3:PutObject permission, but the S3 bucket policy must explicitly grant access to that IAM role (or its principal) for the write operation to succeed. Even if the IAM role allows the action, the bucket policy acts as a separate access control layer; if it denies or does not include the role, the request fails with 'Access Denied'. This is a common cross-account or service-specific permission issue where both identity-based and resource-based policies must align.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Glue job is not configured to write to S3 with the correct prefix
Why it's wrong here
Would cause a different error like 'No such file or directory'.
- ✓
The S3 bucket policy does not grant access to the Glue job's IAM role
Why this is correct
Even if IAM allows, bucket policy can deny; this is a common misconfiguration.
- ✗
The Glue job is running in a VPC without an S3 VPC endpoint
Why it's wrong here
Could be an issue, but the error is access denied, not network.
- ✗
The S3 bucket is encrypted with AWS KMS and the IAM role lacks kms:Decrypt permission
Why it's wrong here
Possible but not indicated; the error message doesn't mention KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.