DVA-C02 Security Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "arn:aws:s3:::example-bucket/confidential/*"
}
]
}A developer attached the IAM policy above to an IAM user. What is the effect when the user tries to download an object from the 'confidential' folder in 'example-bucket'?
⚠ Common exam trap
DVA-C02 often tests the IAM evaluation logic where candidates forget that explicit Deny always wins, leading them to pick the Allow-based answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is denied access because of the explicit Deny statement
In AWS IAM, an explicit Deny statement always overrides any Allow statement, regardless of order or specificity. The policy includes a Deny for s3:* on the confidential folder, so the user is denied access to download objects there even if a separate Allow exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy is invalid because Deny cannot be used with s3:*
Why it's wrong here
The statement is incorrect because Deny is a valid and powerful effect in IAM policies, designed to explicitly revoke permissions. It can be effectively combined with action wildcards like s3:* to deny all Amazon S3 actions, or resource wildcards to deny actions on specific sets of resources. This allows for broad prohibitions, ensuring that no Allow statement can grant access to the specified actions or resources.
- ✗
The user can download only if the object is encrypted
Why it's wrong here
The encryption status of an S3 object does not inherently influence IAM policy evaluation unless a specific condition key is used within the policy. IAM policies evaluate requests based on the requested action, resource, principal, and any specified conditions, such as s3:x-amz-server-side-encryption if the policy explicitly checks for it. Without such a condition, the policy does not differentiate based on encryption.
- ✓
The user is denied access because of the explicit Deny statement
Why this is correct
The user is denied access precisely because of the explicit Deny statement within the IAM policy. According to IAM policy evaluation logic, an explicit Deny always takes precedence over any Allow statements. If a Deny statement matches the requested action (s3:GetObject) and resource (an object within the confidential folder), access is immediately blocked, regardless of other Allow permissions.
- ✗
The user can download the object because of the Allow statement
Why it's wrong here
Due to the fundamental principle of IAM policy evaluation: an explicit Deny always overrides an Allow. Even if there is an Allow statement that would otherwise grant the user permission to download the object, the presence of a matching Deny statement for s3:* actions on resources within the confidential folder will prevent the GetObject operation from succeeding.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.