Refer to the Exhibit Practice Questions

The Deny statement should include a condition on the source IP.

Why it fails: Deny should apply to non-HTTPS regardless of IP.

The Allow statement should include a condition for SecureTransport.

Why it fails: Allow without SecureTransport condition is fine, but Deny is too restrictive.

The Allow statement should specify s3:GetObject instead of s3:GetObject.

Why it fails: Action is correct.

The prefix is incorrect; it should be 'logs/2023/01/01/'.

Why it fails: The prefix is correct.

The bucket policy does not allow listing objects.

Why it fails: If access were denied, the command would fail with an error.

The query syntax is invalid; use a filter instead.

Why it fails: The query is valid.

Denies all uploads unless SSE-S3 is used

Why it fails: The policy permits uploads using the named algorithm rather than denying everything else; a Deny effect with a NotStringEquals condition would be needed to block other encryption types. It is tempting because Deny statements commonly enforce encryption, but this policy's effect is Allow.

Allows only SSE-S3 encrypted uploads

Why it fails: The policy allows the named algorithm but does not exclude other encryption methods, so uploads using SSE-KMS or SSE-C still succeed. It is tempting because the condition names one algorithm, yet Allow with a matching condition does not restrict alternatives.

Allows any type of server-side encryption

Why it fails: The policy's condition keys restrict uploads to a specific encryption algorithm, so it does not permit every server-side encryption type. It is tempting because bucket policies can allow broad encryption, but the explicit StringEquals on the encryption header narrows the permitted set.

The upload failed due to encryption mismatch.

Why it fails: CloudTrail logged the PutObject as successful with no errorCode or errorMessage field, so no failure occurred. It tempts because encryption-mismatch errors do appear in CloudTrail when a bucket policy demands a specific algorithm and the request supplies a different one, which is not what the exhibit shows.

The object was not encrypted at rest.

Why it fails: The exhibit records an x-amz-server-side-encryption header, proving encryption at rest was requested, so claiming none applied misreads the log. It tempts because objects uploaded without any encryption header are indeed stored unencrypted, which is the scenario this statement would correctly describe.

The object was encrypted with SSE-S3.

Why it fails: SSE-S3 produces an x-amz-server-side-encryption header of AES256, but the exhibit shows no such header, so this claim contradicts the logged request. It tempts because SSE-S3 is the default S3 encryption applied when no algorithm is specified, and would be the answer had the event recorded that header.

Change the LOCATION to read from a subfolder.

Why it fails: The LOCATION path is already correct; the failure stems from the SerDe parsing with a comma delimiter, so altering the folder does not change how fields are split. Changing LOCATION is tempting when files sit in subfolders, but the delimiter mismatch remains regardless of path.

Add a partition projection configuration.

Why it fails: Partition projection speeds up query planning by generating partition metadata; it does not alter the SerDe's delimiter, so fields still parse incorrectly. It is tempting for large partitioned datasets, but the actual defect is comma versus pipe delimiting, which projection cannot fix.

Run a crawler to detect the schema automatically.

Why it fails: A crawler infers schema and classification but cannot override the explicit SerDe properties already defined in the DDL, so it would not correct the comma delimiter. Crawlers suit discovering unknown schemas; here the schema is known and only the field delimiter needs changing.

The Lambda function is not in the same region as the Kinesis stream

Why it fails: Cross-region access isn't the blocker: Lambda reads Kinesis streams in its own region, and the stem's access-denied error points to the execution role's IAM policy, not geography. It is tempting because co-locating resources reduces latency and data-transfer costs, so region alignment is a genuine design consideration — just not the cause of an authorisation failure.

The Lambda function does not have permission to list S3 buckets

Why it fails: Listing S3 buckets is irrelevant: the S3 event trigger already delivers the object, and the failure occurs reading Kinesis. This permission would matter only if the function itself enumerated buckets, for example to discover which bucket to process.

The S3 bucket policy denies access to the Lambda function

Why it fails: The S3 bucket policy governs access to S3 objects, not Kinesis. Since the trigger fires and the error arises on the Kinesis read, an S3 denial cannot produce it. Bucket policies would be the cause if the function failed reading the triggering object.

Queries will be throttled because the table does not have a global secondary index.

Why it fails: Throttling stems from exceeding provisioned read capacity, not from the absence of a GSI; the query simply Scans. It tempts because a GSI on customer_id would enable efficient lookups, making its absence feel causal, yet the direct effect is capacity consumption, not automatic throttling.

Queries will be fast because the sort key is indexed.

Why it fails: A sort key is only indexed within its partition, so querying by customer_id alone cannot use it; DynamoDB must Scan every partition. It tempts because range keys do accelerate Query operations when the partition key is also supplied, which is the normal access pattern here.

Queries will cause hot partitions on the table.

Why it fails: Hot partitions arise from uneven partition-key distribution or a monotonically increasing key, not from omitting the partition key in a Query. It tempts because inefficient access patterns can concentrate load, but the actual consequence here is a full table Scan consuming read capacity.

The Glue job is missing the s3:ListBucket permission on the bucket

Why it fails: ListBucket governs listing objects in the bucket, not the PutObject write itself, so its absence cannot cause the write denial. It is tempting because ListBucket is frequently omitted from policies, and it would be correct if the job failed while enumerating bucket contents.

The S3 bucket is encrypted with AWS KMS and the policy does not include kms:Decrypt permissions

Why it fails: KMS Decrypt applies to reading KMS-encrypted objects; the failure occurs when writing to S3, which requires kms:GenerateDataKey instead. It is tempting because KMS key policies commonly cause access denied, and it would be correct if the job were reading encrypted data.

The Glue job does not have permission to call glue:StartJobRun

Why it fails: StartJobRun governs triggering the job, not writing objects to S3, so it cannot explain the write failure. It is tempting because Glue permissions are commonly misconfigured, and it would be correct if the job failed to start rather than failing during the S3 write.

The policy allows both HTTP and HTTPS access.

Why it fails: The policy includes a Deny on aws:SecureTransport false, which blocks plain HTTP, so only HTTPS succeeds. It is tempting because bucket policies can permit both schemes when no transport condition exists, and that would be correct for a bucket with no HTTPS-only requirement.

The policy allows anonymous access to list objects in the bucket.

Why it fails: The exhibit's policy grants s3:GetObject to a principal, not s3:ListBucket, so listing is denied regardless of the anonymous principal. It is tempting because anonymous principals in a bucket policy do expose data, and such a statement would be correct if its action were s3:ListBucket on the bucket ARN.

The policy requires the use of AWS KMS for server-side encryption.

Why it fails: The policy conditions on aws:SecureTransport and encryption headers, not on s3:x-amz-server-side-encryption-aws-kms-key-id, so KMS is never mandated. It is tempting because KMS keys are the usual way to enforce SSE-KMS, and such a condition would be correct where the requirement is customer-managed key encryption.

The allow statement is evaluated before the deny statement

Why it fails: IAM evaluates all statements together; an explicit Deny always overrides any Allow regardless of order, so sequencing is not the cause. Ordering matters only for readability, not evaluation. The stem's deny on the confidential prefix blocks reads even though a broad Allow exists, which is the actual mechanism at fault.

The deny statement is missing an explicit allow for the confidential prefix

Why it fails: An explicit Deny cannot be overridden by adding an Allow; AWS always evaluates Deny first and it wins. The policy already permits s3:GetObject broadly, so the missing element is not an Allow. This option misreads how deny-and-allow interact, which is the core IAM evaluation logic tested here.

The resource ARN in the deny statement is incorrect

Why it fails: If the deny statement's resource ARN were malformed, it would not match the confidential prefix and reads would succeed, contradicting the reported failure. ARN accuracy matters for scoping denies, but here the deny correctly targets confidential/* and is what blocks access. The stem's symptom confirms the ARN matches.

The table does not have any partitions defined

Why it fails: Absent partition definitions would mean no ds column exists, contradicting the stem's stated partitioning. Equal scan sizes instead point to filters that fail to prune, such as functions wrapped around ds; missing partitions is the correct diagnosis only when the schema shows none.

The table is not partitioned

Why it fails: Equal data scanned across queries filtering different ds values indicates partition pruning is not occurring, often because filters are not applied to the partition column. A genuinely unpartitioned table is a different condition, detectable from its schema rather than scan sizes.

Partition pruning is working correctly

Why it fails: Identical scan volumes across both queries mean the 'ds' filter was not pushed down, so every partition was read; genuine pruning would show one query scanning far less. It tempts engineers who equate equal scans with consistent behaviour, but pruning is confirmed only when a narrowed predicate reduces bytes scanned.

The KMS key policy does not allow decryption.

Why it fails: A restrictive key policy would deny decryption even with the correct encryption context present, so it cannot explain a failure tied specifically to omitting that context. Key-policy review applies when a principal lacks kms:Decrypt permission for all attempts.

The KMS key has been disabled.

Why it fails: A disabled key would fail decryption regardless of whether the encryption context were supplied, yet the stem implies the context is the variable. Disabling keys is the right check when every operation using that key fails, not when only context-omitting calls do.

The plaintext file was corrupted.

Why it fails: Corruption would produce a generic integrity or ciphertext error, not the context-mismatch failure KMS reports when the supplied encryption context differs from the one bound at encryption. Corruption checks suit files damaged in transit or storage, where decryption fails irrespective of context.

The policy is missing permissions for AWS KMS to decrypt/encrypt objects

Why it fails: KMS permissions affect encryption and decryption of object data, not the S3 write authorisation itself; the access denied occurs because the policy lacks s3:PutObject on the output bucket. It is tempting because KMS key policy errors do produce access denied on SSE-KMS buckets, which is the right diagnosis when reads or writes fail only on encrypted objects.

The policy does not allow glue:StartJobRun on the specific job

Why it fails: glue:StartJobRun governs starting the job, not writing objects, so its absence cannot cause an access denied during the write phase; the missing action is s3:PutObject on the output bucket. It is tempting because IAM policies for Glue jobs do need Glue actions, which are required when the role itself launches runs.

The policy does not include s3:ListBucket permission

Why it fails: Writing objects needs s3:PutObject on the output bucket; ListBucket governs enumeration only, so its absence cannot cause the write denial. It is tempting because ListBucket is commonly bundled with read access, and it would be the correct fix if the job failed while listing bucket contents.

Modify the S3 event notification to use a different event type

Why it fails: The event type only determines when the function is invoked; it does not affect how long processing takes, so the timeout recurs. Changing event types is correct when you must filter which object operations trigger invocation, for example excluding DELETE events or reacting only to multipart uploads.

Grant the Lambda function permission to access DynamoDB

Why it fails: Missing DynamoDB permissions cause AccessDeniedException errors, not timeouts, so granting them leaves the function still exceeding its configured timeout. The policy is genuinely required for the write to succeed, making it a plausible fix, but the stem's symptom points to execution duration rather than authorisation.

Change the trigger to Amazon SQS instead of S3

Why it fails: Replacing the S3 trigger with Amazon SQS decouples ingestion but does not shorten the function's execution time, so the timeout persists. SQS triggering is the right design when you need buffering, retries or batching to absorb spikes, not when a single invocation simply runs longer than its allotted seconds.

Increase the number of DPUs for the job to reduce runtime.

Why it fails: Adding DPUs scales compute for data processing and shortens runtime, but does not raise the API request quota that triggered the ThrottlingException. It would help a slow, resource-bound job, yet the error indicates exceeded service limits, so requesting a quota increase is the appropriate remedy.

Use AWS Glue reserved capacity to guarantee API throughput.

Why it fails: Reserved capacity guarantees DPU availability for Glue jobs, not API request throughput, so it cannot resolve a ThrottlingException. It would suit predictable, high-volume workloads needing consistent compute, but the throttling stems from exceeding service quotas, which require a quota increase request.

Delete old job runs to reduce the number of entries in the job run history.

Why it fails: Deleting job run history removes only metadata records; it cannot reduce the concurrent Glue job or DPU capacity that triggers ThrottlingException. Pruning history is tempting for tidiness or audit limits, but the fix requires raising the account's concurrent job run limit or reducing simultaneous runs.