DVA-C02 Security Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"BoolIfExists": {
"aws:SecureTransport": "false"
}
}
}
]
}A developer attaches the above S3 bucket policy to my-bucket. A user tries to upload an object using HTTP (not HTTPS). What will happen?
⚠ Common exam trap
DVA-C02 often tests the misconception that an Allow in another policy can override an explicit Deny, when in fact explicit Deny always wins.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The upload is denied
The bucket policy includes a Deny effect for requests where aws:SecureTransport is false (i.e., HTTP). Since the user is uploading via HTTP, the condition is true, so the Deny statement applies and the upload is denied. Explicit Deny always overrides any Allow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The upload succeeds because the Deny effect only applies if the condition is true
Why it's wrong here
This reverses the logic of IAM condition evaluation: a Deny statement with an aws:SecureTransport condition applies precisely when the condition evaluates to true, and since the HTTP request has SecureTransport equal to false, the condition matches and the Deny is enforced, not skipped.
- ✗
The upload succeeds if the user also has an Allow in another policy
Why it's wrong here
In IAM's policy evaluation logic, an explicit Deny always takes precedence over any Allow statement from any policy attached to the principal, whether identity-based or resource-based, so no combination of additional Allow permissions can override the bucket policy's Deny.
- ✓
The upload is denied
Why this is correct
The bucket policy's Deny statement with a Bool condition on aws:SecureTransport equal to false is specifically designed to block any request not sent over HTTPS; since the upload is over plain HTTP, the condition is satisfied and the request is denied at the S3 service level.
- ✗
The upload succeeds because there is no Allow statement
Why it's wrong here
The evaluation outcome here has nothing to do with whether an Allow statement exists; the explicit Deny statement is what determines the result, and since it matches, the request is rejected regardless of any Allow being present or absent elsewhere.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.