DVA-C02 Troubleshooting and Optimization Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Principal": "*"
},
{
"Effect": "Deny",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/secret/*",
"Principal": "*"
}
]
}A developer attaches the above bucket policy to an S3 bucket. An anonymous user tries to access https://my-bucket.s3.amazonaws.com/secret/key.txt. What is the result?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access is denied because the explicit Deny overrides the Allow.
The explicit Deny statement for the 'secret/' prefix overrides the Allow statement that grants access to all objects. Even though the Allow grants access to all objects, the Deny specifically denies access to objects under 'secret/', and explicit Deny always takes precedence. Option B is incorrect because the Deny overrides the Allow for the specified prefix. Option C is incorrect because Deny statements apply to all users, including anonymous users. Option D is incorrect because having two statements that conflict does not make the policy invalid; the explicit Deny simply takes precedence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Access is denied because the explicit Deny overrides the Allow.
Why this is correct
AWS IAM policy evaluation uses an explicit deny as an absolute override: if a bucket policy contains an applicable Deny statement for the same principal, action, and resource, that Deny takes precedence over any Allow statement. This precedence rule holds regardless of whether the Allow appears in the same policy or in a different IAM policy attached to the requester, so the anonymous (unauthenticated) request is blocked even though the Allow statement would otherwise match S3:GetObject.
- ✗
Access is allowed because the Allow statement covers all objects.
Why it's wrong here
The Allow statement does cover all objects in the bucket, but an applicable explicit Deny in the same bucket policy supersedes it. In AWS authorization logic, any matching Deny statement — in one or more policies — causes the request to be denied, no matter how broad or permissive an Allow statement is. Therefore, the existence of a valid Allow does not indicate that access is granted; the Deny is the deciding factor.
- ✗
Access is allowed because anonymous requests are not affected by Deny statements.
Why it's wrong here
Anonymous requests are sent without any IAM identity, so they are evaluated as the wildcard principal "*". In S3 bucket policies, a Deny with Principal "*" explicitly applies to anonymous users as well as authenticated users; there is no special exemption that lets anonymous traffic bypass Deny statements. In fact, S3 only allows anonymous access when an explicit Allow grants it, and that grant is nullified by any matching Deny.
- ✗
Access is denied because the policy is invalid (two statements conflict).
Why it's wrong here
The policy is not invalid for containing conflicting statements; AWS policies routinely combine Allow and Deny statements, and IAM's evaluation model simply applies the deny-first rule. A valid policy may have multiple statements that overlap or appear contradictory because the evaluation engine checks for an explicit Deny before granting access. Thus, the request is denied because of the Deny's precedence, not because the policy is malformed or rejected.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.