DEA-C01 Data Store Management Practice Question
Which TWO statements are true about Amazon S3 bucket policies and ACLs?
⚠ Common exam trap
Many candidates confuse ACLs with bucket policies, assuming ACLs support advanced conditions like IP restrictions or that bucket policies and ACLs are evaluated in a strict order, when in fact ACLs are simplistic and both are evaluated as an OR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACLs are a legacy access control mechanism that is still supported.
ACLs (Access Control Lists) are indeed a legacy access control mechanism that Amazon S3 continues to support for backward compatibility. While bucket policies and IAM policies are the modern, recommended approach, ACLs can still be used to grant basic read/write permissions to AWS accounts or predefined groups like AllUsers or AuthenticatedUsers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
When both exist, bucket policies are evaluated before ACLs.
Why it's wrong here
Both are evaluated, but ACLs are evaluated first.
- ✓
ACLs are a legacy access control mechanism that is still supported.
Why this is correct
ACLs are older but still functional.
- ✗
ACLs can grant permissions to all authenticated AWS users.
Why it's wrong here
ACLs can grant permissions to specific AWS accounts or groups, not all authenticated users.
- ✗
ACLs support conditions such as IP address restrictions.
Why it's wrong here
ACLs do not support conditions; bucket policies do.
- ✓
Bucket policies can grant access to users in other AWS accounts.
Why this is correct
Bucket policies can specify cross-account principals.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.