DVA-C02 Development with AWS Services Practice Question
Network Topology
An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?
⚠ Common exam trap
It's easy for candidates to confuse MFA Delete with standard versioning behavior, assuming a delete marker is created as a fallback, but MFA Delete strictly denies any permanent deletion request without the required authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request is denied with an AccessDenied error.
When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A delete marker is created for the object version.
Why it's wrong here
When a DELETE request explicitly specifies an object's version ID, the intent is to permanently remove that particular version from the bucket. In such a scenario, Amazon S3 does not create a delete marker. Delete markers are only generated when a DELETE request is made for an object without specifying a version ID in a versioning-enabled bucket, serving to logically hide the current object version rather than physically deleting it.
- ✗
The object version is permanently deleted.
Why it's wrong here
With MFA Delete enabled on an S3 bucket, any attempt to permanently delete an object version requires an additional layer of security: a valid Multi-Factor Authentication (MFA) token. If the deletion request does not include this mandatory MFA token, S3's security controls will prevent the permanent removal of the object version. Therefore, the object version will not be deleted, regardless of other permissions the requester might possess.
- ✓
The request is denied with an AccessDenied error.
Why this is correct
Since MFA Delete is configured for the S3 bucket, any operation that results in the permanent deletion of an object version, such as deleting a specific version ID, necessitates the inclusion of a valid MFA token in the request. If the DELETE request targeting a specific version ID lacks this required MFA authentication, Amazon S3 will strictly enforce the MFA Delete policy. Consequently, the request will be rejected, and an AccessDenied error will be returned to the caller.
- ✗
The object version is marked with a delete marker.
Why it's wrong here
A delete marker is a special type of object version that S3 creates to logically delete an object when a DELETE request is issued without specifying a version ID in a versioning-enabled bucket. This action hides the current version from normal GET requests but does not physically remove any specific object version. When a request does specify a version ID, the intention is a permanent deletion of that specific version, not the creation of a logical delete marker.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.