DVA-C02 Security Practice Question
An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?
⚠ Common exam trap
A common mix-up: candidates assume an IAM role with an allow policy is sufficient, overlooking that S3 bucket policies can contain explicit deny statements that override the role's permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.
Even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check that the application is using HTTPS instead of HTTP.
Why it's wrong here
S3 buckets generally allow both HTTP and HTTPS access by default. An access denial based on protocol would only occur if the S3 bucket policy explicitly enforces secure transport using a condition like `aws:SecureTransport`. Without such a specific policy, the application's use of HTTP would not typically be the root cause of an access issue, as S3 supports both protocols.
- ✓
Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.
Why this is correct
AWS IAM policy evaluation logic dictates that an explicit deny statement always overrides any allow statements, regardless of where they are defined. If the S3 bucket policy contains an explicit deny that matches the EC2 instance's IAM role or the request's attributes, access will be blocked. This powerful mechanism ensures that specific access restrictions are enforced even if broader permissions are granted elsewhere, making it a critical check.
- ✗
Check that the EC2 instance has permissions to decrypt the KMS key used by S3.
Why it's wrong here
Permissions to decrypt a KMS key are only necessary if the S3 objects are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS). S3 also supports SSE-S3, which uses S3-managed keys, and SSE-C, which uses customer-provided keys, neither of which require client-side KMS permissions. Since the question does not specify the encryption method, assuming SSE-KMS and checking KMS permissions is a premature troubleshooting step.
- ✗
Check that the EC2 instance is in the same VPC as the S3 bucket.
Why it's wrong here
Amazon S3 is a highly available, globally distributed service that exists outside of any specific VPC. S3 buckets are accessed via public endpoints or private VPC endpoints (Gateway or Interface), not by being 'inside' a VPC themselves. Therefore, the EC2 instance's VPC location relative to the S3 bucket has no bearing on its ability to access the bucket, making this check irrelevant for basic connectivity.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.