DVA-C02 Security Practice Question
A developer is configuring an S3 bucket to host a static website. The bucket policy allows public read access. However, users receive a 403 Forbidden error when accessing the website. What is the most likely cause?
⚠ Common exam trap
Many candidates assume a bucket policy granting public read access is sufficient for static website hosting, overlooking that S3's Block Public Access settings act as a separate, overriding permission layer that can silently deny all public access even when the bucket policy is correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket has 'Block all public access' settings enabled.
The 'Block all public access' settings in the S3 bucket's Permissions tab override any bucket policy that grants public read access. Even if the bucket policy explicitly allows s3:GetObject for Principal "*", enabling any of the four block public access settings (especially 'Block public access to buckets and objects granted through new public bucket policies' or 'Block public and cross-account access to buckets and objects through any public bucket policies') will cause S3 to reject all anonymous requests, resulting in a 403 Forbidden error when accessing the static website endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket is located in a different AWS region than the website endpoint.
Why it's wrong here
S3 static website hosting is a region-specific feature, meaning the S3 bucket must reside in the same AWS region where the static website endpoint is being accessed or configured. If the bucket is located in a different AWS region, the S3 static website endpoint URL for that region will not correctly resolve or serve content from the mismatched bucket. This regional discrepancy prevents the static website from being publicly accessible.
- ✗
The bucket name does not match the domain name.
Why it's wrong here
For S3 static website hosting, the bucket name is only strictly required to match the custom domain name (e.g., 'example.com' for 'example.com') if you intend to use the root domain directly with the S3 website endpoint without a custom DNS service. When using AWS Route 53 or another DNS provider, you can create a CNAME or Alias record to point your custom domain to the S3 static website endpoint, regardless of the bucket's name. Therefore, a bucket name mismatch is not inherently a blocker for static website hosting with proper DNS configuration.
- ✓
The bucket has 'Block all public access' settings enabled.
Why this is correct
The S3 Block Public Access settings are a powerful security control that overrides any bucket policies or access control lists (ACLs) that might otherwise grant public read access. When 'Block all public access' is enabled, it explicitly prevents anonymous users from accessing objects within the bucket, including static website content. For a static website to be publicly accessible, these settings must be disabled, specifically the 'Block public and cross-account access to buckets and objects' option, allowing the bucket policy to grant public read permissions.
- ✗
The bucket is not configured with CloudFront as a content delivery network.
Why it's wrong here
While AWS CloudFront is frequently used with S3 static websites to enhance performance through caching, provide HTTPS support, and add security layers like AWS WAF, it is not a mandatory component for basic S3 static website hosting. An S3 bucket can directly serve static content over HTTP using its dedicated website endpoint without any dependency on a Content Delivery Network. Therefore, the absence of CloudFront does not prevent the fundamental functionality of an S3 static website.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.