DVA-C02 Troubleshooting and Optimization Practice Question
A developer is using Amazon S3 to host a static website. The website returns 403 Forbidden errors. The bucket policy allows public read access. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on the bucket policy syntax or ACLs, overlooking the fact that S3's Block Public Access settings can silently override all public permissions, even when the policy is perfectly written.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket's 'Block public access' settings are enabled.
The most likely cause is that the bucket's 'Block public access' settings are enabled. Even if the bucket policy explicitly grants public read access, S3's Block Public Access settings act as an overarching security override that denies all public requests, resulting in a 403 Forbidden error. These settings are enabled by default for new buckets and can be applied at the account or bucket level, making them a common pitfall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The bucket's 'Block public access' settings are enabled.
Why this is correct
This is the correct reason. Amazon S3 Block Public Access settings provide a critical security layer that overrides all other access control mechanisms, including bucket policies and ACLs, to prevent public access to S3 buckets and objects. If these settings are enabled at either the account or bucket level, they will effectively block any public read access, even if a bucket policy explicitly grants 's3:GetObject' permissions to the public, thereby preventing the static website from loading.
- ✗
The bucket has an ACL that denies read access.
Why it's wrong here
While Access Control Lists (ACLs) can deny read access, they are generally less granular and often superseded by bucket policies for public access scenarios, especially when Block Public Access settings are the primary concern. If a bucket policy explicitly grants public read access for static website hosting, an ACL denying read access would not be the definitive reason for the website's failure if Block Public Access settings are enabled, as those settings take precedence over both ACLs and bucket policies.
- ✗
The bucket policy does not include the 's3:GetObject' action.
Why it's wrong here
The question stem explicitly states that the developer has configured the bucket policy to "allow public read access." For a static website to function, public read access fundamentally requires the 's3:GetObject' action to retrieve the website's files. Therefore, if the policy truly allows public read access as stated, it must inherently include 's3:GetObject', making this option contradictory to the problem's premise.
- ✗
The bucket policy is not correctly attached to the bucket.
Why it's wrong here
If the bucket policy were not correctly attached or contained syntax errors, it would not be active and thus would not "allow public read access" as described in the scenario. The problem implies that a policy is in place and intends to grant public read access, but something else is preventing it. An unattached or malformed policy would simply mean no public access is granted at all, rather than public access being granted but then blocked.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.