DVA-C02 Explicit Deny Practice Question
Exhibit
Refer to the exhibit.
IAM Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::my-bucket",
"arn:aws:s3:::my-bucket/*"
]
},
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}Given the IAM policy above, what is the effective permission for an IAM user?
⚠ Common exam trap
Candidates often misinterpret 'full access except delete' as including write permissions, but the policy only grants read and list actions. The explicit deny on delete does not add write permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Read-only access to the bucket.
The IAM policy grants only s3:GetObject and s3:ListBucket permissions, which allow reading objects and listing the bucket, and explicitly denies s3:DeleteObject. Since no write permissions (e.g., s3:PutObject) are granted, the effective permission is read-only access (list and get) with delete explicitly denied. Therefore, the user has read-only access to the bucket, not full access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No access to the bucket.
Why it's wrong here
The Allow statement still grants the permitted S3 actions, so access is not absent; only delete is blocked by the explicit Deny. No access would be correct if the policy contained no Allow statement, or if an explicit Deny covered all actions.
- ✗
Full access to the bucket including delete.
Why it's wrong here
An explicit Deny for s3:DeleteObject in the policy overrides any Allow, so delete cannot succeed. Full access is tempting because the Allow statement grants all other S3 actions on the bucket, which is the correct outcome only when no Deny statement is present.
- ✓
Read-only access to the bucket.
Why this is correct
The policy grants only s3:GetObject and s3:ListBucket actions, with no PutObject, DeleteObject or bucket-level write permissions attached. The IAM user can therefore retrieve and enumerate objects but cannot modify or remove them, giving read-only access.
- ✗
Full access to the bucket except delete.
Why it's wrong here
The policy's explicit Deny on s3:DeleteObject overrides any Allow, so delete is blocked, but the stem's policy may also omit other actions; full access minus delete is only correct when every other action is allowed. Reading the actual statements determines the effective permission.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.