DVA-C02 Security Practice Question
A company has an S3 bucket with a policy that denies access to all users. The bucket owner wants to grant read access to a specific IAM user. What must be done?
⚠ Common exam trap
DVA-C02 often tests the misconception that an Allow statement can override an explicit Deny, but AWS policy evaluation always gives Deny precedence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the Deny statement from the bucket policy.
In S3 bucket policies, an explicit Deny always overrides any Allow. Since the bucket policy currently denies access to all users, simply adding an Allow statement for the specific IAM user will not work—the Deny will still take precedence. Therefore, the Deny statement must be removed or modified to exclude that user before an Allow can be effective. Option C is correct because it addresses the root cause: the explicit Deny must be eliminated to permit any access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new bucket and copy objects there.
Why it's wrong here
Migrating objects to a brand-new bucket introduces operational overhead, cost, and risk of broken references, and does nothing to address the root cause — the explicit Deny statement — so it's an unnecessarily destructive workaround rather than a fix.
- ✗
Add an Allow statement in the bucket policy for the user.
Why it's wrong here
In IAM policy evaluation, an explicit Deny always takes precedence over any Allow statement regardless of where each is defined, so adding another Allow clause alongside an existing bucket-wide Deny has no effect — the user is still blocked.
- ✓
Remove the Deny statement from the bucket policy.
Why this is correct
Because an explicit Deny overrides every other permission source, the deny statement itself must be removed (or narrowed with a condition excluding the user) before any Allow — whether from IAM policy, bucket policy, or ACL — can actually grant access.
- ✗
Add the user to the bucket ACL with read permission.
Why it's wrong here
ACLs are evaluated as another form of grant within the overall access evaluation, and just like an Allow statement, they are still subordinate to an explicit Deny in the bucket policy, so adding an ACL entry cannot override the existing deny.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.