DVA-C02 Troubleshooting and Optimization Practice Question
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}
```A developer receives an Access Denied error when trying to download an object from an S3 bucket. The developer's IAM policy is shown in the exhibit. The bucket policy also grants access. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket uses SSE-KMS and the user lacks kms:Decrypt permission.
If the bucket is encrypted with a KMS key, the user must also have kms:Decrypt permission. Option A is wrong because the policy explicitly allows s3:GetObject. Option C is wrong because the bucket policy also grants access, so it's not a bucket policy issue. Option D is wrong because public access is not required if IAM policies allow access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket has block public access enabled.
Why it's wrong here
S3 Block Public Access settings only prevent anonymous or public-access grants such as public ACLs and public bucket policies from taking effect; they have no impact on requests made by an authenticated IAM principal that already has explicit Allow permissions from both an IAM policy and a bucket policy, so this setting would not cause the described Access Denied error.
- ✓
The S3 bucket uses SSE-KMS and the user lacks kms:Decrypt permission.
Why this is correct
When an object is encrypted with SSE-KMS, retrieving it requires not only s3:GetObject permission on the object but also kms:Decrypt permission on the specific KMS key used to encrypt it; if the IAM policy grants only the S3 action and omits the KMS action, the decrypt call fails and S3 surfaces this as an Access Denied error even though the S3-level permissions look correct.
- ✗
The IAM policy does not allow s3:GetObject.
Why it's wrong here
The scenario states the IAM policy shown grants the developer access and the question asks for the most likely cause given both the IAM policy and bucket policy already grant access; since s3:GetObject is stated to be present, a missing GetObject permission contradicts the given facts and points instead to a different underlying cause.
- ✗
The bucket policy denies access to the user.
Why it's wrong here
IAM evaluates an explicit Deny in any applicable policy as an absolute override that blocks the request regardless of other Allow statements, but the scenario explicitly states the bucket policy grants access rather than denying it, so a conflicting explicit Deny within the bucket policy is not present here and cannot be the cause.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.