DVA-C02 Security Practice Question
A developer is troubleshooting an IAM policy that is supposed to allow a Lambda function to read objects from an S3 bucket. The Lambda function role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket/*","arn:aws:s3:::example-bucket"]}]}. Despite this, the Lambda function receives an AccessDenied error when trying to read objects. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume the IAM policy alone is sufficient and overlook the possibility of a bucket policy that explicitly denies access, which overrides any IAM allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket has a bucket policy that explicitly denies the Lambda function's access.
The IAM policy attached to the Lambda function role correctly grants s3:GetObject and s3:ListBucket permissions on the bucket and its objects. However, if the S3 bucket itself has a bucket policy that explicitly denies access to the Lambda function's role, that explicit deny overrides any allow from IAM policies, resulting in an AccessDenied error. This is because AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The S3 bucket has a bucket policy that explicitly denies the Lambda function's access.
Why this is correct
AWS IAM policy evaluation logic dictates that an explicit deny in any applicable policy always overrides an explicit allow. Even if the Lambda function's execution role has an IAM policy granting s3:GetObject access, a bucket policy on the target S3 bucket that explicitly denies access to that specific Lambda role will prevent the action. This creates an effective deny, regardless of the identity-based policy, making it the most probable cause for troubleshooting.
- ✗
The IAM policy does not include the s3:GetObjectVersion action.
Why it's wrong here
The s3:GetObjectVersion action is specifically used to retrieve a particular version of an object from a versioned S3 bucket. However, the question implies a general failure to retrieve an object, for which the s3:GetObject action is sufficient to retrieve the current version by default. Without explicit mention of needing to access a non-current object version, requiring s3:GetObjectVersion is an unnecessary and incorrect assumption for troubleshooting a basic access issue.
- ✗
The Lambda function is in a different AWS account than the S3 bucket.
Why it's wrong here
While cross-account access requires specific configuration, it is a fully supported and common use case in AWS. A Lambda function in one AWS account can successfully access an S3 bucket in another account, provided the S3 bucket policy grants the necessary permissions to the Lambda function's execution role ARN from the other account. Therefore, simply being in a different account does not inherently cause access failure if policies are correctly configured.
- ✗
The IAM policy uses an incorrect resource ARN format.
Why it's wrong here
The question stem provides no information to suggest that the IAM policy's resource ARN format is incorrect. AWS ARNs follow a well-defined structure, and developers typically use correct formats. An incorrect ARN format would usually lead to errors indicating an invalid resource or syntax, rather than a policy-based access denial, implying the resource is identifiable but access is forbidden.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.