DVA-C02 Security Practice Question
A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An SCP at the organization level denies s3:GetObject.
The correct answers are A, C, and E. An organization-level SCP can deny s3:GetObject, overriding IAM allows. An explicit deny in the user's role policy also overrides any allow. A bucket policy with an explicit Deny statement will cause access denied even if IAM allows. Option B is incorrect because using a wrong region endpoint results in a different error (e.g., NoSuchBucket or redirect), not an access denied. Option D is incorrect because cross-account access is possible with proper permissions; the bucket being in another account does not inherently deny access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An SCP at the organization level denies s3:GetObject.
Why this is correct
Correct. An SCP at the organization level can deny s3:GetObject for all accounts, overriding any IAM allow.
- ✗
The user is using an incorrect region endpoint.
Why it's wrong here
Incorrect. Using an incorrect region endpoint results in a different error, not an access denied error.
- ✓
The user's IAM role has an attached policy that denies s3:GetObject.
Why this is correct
Correct. An explicit deny in the user's IAM role policy will override any allow policies, causing access denied.
- ✗
The S3 bucket is in a different AWS account.
Why it's wrong here
Incorrect. The bucket being in a different AWS account does not inherently cause access denied; cross-account access can be configured.
- ✓
A bucket policy explicitly denies the user.
Why this is correct
Correct. A bucket policy with an explicit Deny statement overrides any IAM allow policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.