DEA-C01 Data Store Management Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "true"
}
}
}
]
}Refer to the exhibit. An IAM policy is attached to a user. The user cannot upload objects to the S3 bucket 'example-bucket' using the AWS CLI. What is the most likely cause?
⚠ Common exam trap
AWS often tests the `aws:SecureTransport` condition key as a hidden denial, leading candidates to incorrectly assume the action is missing or the ARN is malformed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is not using HTTPS for API calls
The IAM policy explicitly denies all actions unless the request uses HTTPS (via the `aws:SecureTransport` condition key). Since the AWS CLI by default can use HTTP if not explicitly configured to use HTTPS, the user's upload attempt fails. The `s3:PutObject` action is allowed in the policy, but the condition block overrides that permission when the request is not made over HTTPS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user is not using HTTPS for API calls
Why this is correct
The condition aws:SecureTransport requires HTTPS.
- ✗
The policy does not allow s3:PutObject
Why it's wrong here
The policy includes s3:PutObject.
- ✗
The user is not in the same AWS region
Why it's wrong here
Region is not a factor.
- ✗
The resource ARN does not include the bucket itself
Why it's wrong here
The resource includes /*, which covers objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.