DVA-C02 Deployment Practice Question
Exhibit
Refer to the exhibit.
```
Resources:
MyBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: my-unique-bucket-123
VersioningConfiguration:
Status: Enabled
MyBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref MyBucket
PolicyDocument:
Statement:
- Effect: Allow
Principal: "*"
Action: "s3:GetObject"
Resource: !Sub "${MyBucket.Arn}/*"
```A developer created a CloudFormation template to host a static website. After deployment, the website returns 403 Forbidden errors. What is the most likely cause?
⚠ Common exam trap
Candidates often confuse the causes of 403 Forbidden and 404 Not Found errors on S3. A 403 Forbidden error on a website endpoint points to a permissions issue (such as a missing bucket policy or active Block Public Access settings). If static website hosting were not enabled, the website endpoint would not resolve or function at all, rather than returning a 403 Forbidden error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy does not allow public access.
An 'Access Denied' (403 Forbidden) error on an Amazon S3 static website endpoint indicates that the requester does not have permission to access the resource. By default, all new S3 buckets and objects are private. To allow public access to the website's assets, you must add a bucket policy that grants public read permissions (`s3:GetObject`) to anonymous users, and ensure that S3 Block Public Access settings are disabled. If static website hosting were not enabled, the website endpoint would not return a 403 Forbidden error; it would not resolve or would return a 404 error. Therefore, the missing bucket policy is the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket has versioning enabled, which blocks public access.
Why it's wrong here
Enabling S3 bucket versioning allows you to keep multiple versions of an object in the same bucket, protecting against accidental deletions or overwrites. This feature is designed for data durability and recovery, not for controlling access permissions. Therefore, versioning itself does not inherently block public access; access is governed by bucket policies, ACLs, and S3 Block Public Access settings, independent of versioning status.
- ✗
The bucket name is not unique.
Why it's wrong here
The CloudFormation template implicitly or explicitly defines a unique bucket name. AWS S3 bucket names must be globally unique across all AWS accounts, and CloudFormation ensures this by either requiring a unique name in the template or appending unique identifiers if a simple name is provided and not explicitly marked as 'DeletionPolicy: Retain' or 'UpdateReplacePolicy: Retain'. Therefore, the bucket name itself, as deployed by a valid CloudFormation template, would be unique and not the cause of access issues.
- ✓
The bucket policy does not allow public access.
Why this is correct
The bucket policy explicitly includes 'Principal: "*"', which is the standard declaration for granting public access to an S3 bucket. This principal allows any user, authenticated or unauthenticated, to perform the specified actions on the bucket's objects, assuming no other conflicting policies or S3 Block Public Access settings override it. Therefore, the bucket policy itself is configured to permit public access, making this option incorrect as the reason for access failure.
- ✗
The bucket does not have static website hosting enabled.
Why it's wrong here
For an S3 bucket to function as a static website and serve content via a website endpoint (e.g., bucket-name.s3-website.region.amazonaws.com), the static website hosting feature must be explicitly enabled. Without this configuration, the bucket will only be accessible via the standard S3 REST API endpoint (e.g., bucket-name.s3.region.amazonaws.com), which typically requires authenticated requests and does not process index.html or error.html documents automatically. Consequently, even with public read permissions, the content won't be served as a website.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.