DVA-C02 Deployment Practice Question
A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket with a bucket policy that grants public read access. The stack creation fails with the error 'Access Denied for bucket: bucket-policy does not allow access.' The developer has full administrative permissions in AWS. The developer verifies that the bucket policy is correctly formatted. What is the most likely cause of the failure?
⚠ Common exam trap
Candidates often assume that having full AdministratorAccess IAM permissions bypasses all restrictions. However, S3 Block Public Access acts as a guardrail that overrides IAM permissions, causing the PutBucketPolicy API call to fail with Access Denied even for administrators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 Block Public Access settings are enabled at the account level, preventing the bucket policy from granting public access.
AWS S3 Block Public Access settings (at the account or bucket level) prevent the creation of public bucket policies. When CloudFormation attempts to apply a public bucket policy while Block Public Access is enabled, S3 rejects the PutBucketPolicy API call with an 'Access Denied' error. Since the developer has full administrative permissions, the failure is not due to missing IAM permissions but rather S3 Block Public Access blocking the public policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer does not have permissions to create S3 buckets.
Why it's wrong here
This is incorrect because the existing note states the developer has full admin permissions. A developer with full administrator access inherently possesses the s3:CreateBucket permission, which is necessary to provision an S3 bucket. If this were a permissions issue, the CloudFormation error would specifically indicate an AccessDenied error during the CreateBucket API call, rather than an issue related to applying a bucket policy that grants public access.
- ✗
The S3 bucket name is already in use by another account.
Why it's wrong here
An S3 bucket naming conflict would result in a different error message during CloudFormation deployment. S3 bucket names are globally unique, and if the chosen name were already taken by another AWS account, the error would explicitly state BucketAlreadyExists or BucketAlreadyOwnedByYou during the bucket creation phase, clearly indicating a naming collision, not a problem with applying a public access policy.
- ✓
The S3 Block Public Access settings are enabled at the account level, preventing the bucket policy from granting public access.
Why this is correct
This is the correct explanation. AWS S3 Block Public Access (BPA) settings, when enabled at the account level, override any bucket policies that attempt to grant public read or write access to S3 buckets or objects. If a CloudFormation template attempts to deploy an S3 bucket with a bucket policy that grants public access, and account-level BPA is active, the policy application will fail because the BPA settings take precedence, effectively blocking the public access grant and causing the stack creation to roll back.
- ✗
The S3 bucket is encrypted with AWS KMS, and the bucket policy does not include kms:Decrypt permissions.
Why it's wrong here
A missing kms:Decrypt permission in a bucket policy would typically manifest as an access denied error when attempting to retrieve or decrypt objects from the S3 bucket, not during the initial creation or application of a bucket policy that grants public access. The CloudFormation error would specifically reference KMS key access issues if this were the problem, rather than a conflict with public access settings.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.