DVA-C02 Troubleshooting and Optimization Practice Question
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-bucket/secret/*"
}
]
}
```Refer to the exhibit. An IAM policy is attached to a user. The user tries to download an object from s3://my-bucket/secret/config.txt. What will happen?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.
The Deny statement explicitly denies all s3 actions on the 'secret/' prefix. Deny statements override Allow statements. Therefore, the user is denied access to objects under the 'secret/' prefix, including s3://my-bucket/secret/config.txt. Option D is correct. Option A is incorrect because the explicit Deny overrides any bucket policy allow. Option B is incorrect because the Deny applies to all s3 actions, including s3:GetObject, and is scoped to the 'secret/' prefix. Option C is incorrect because the Allow statement does not grant access to the 'secret/' prefix; the Deny overrides it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is denied access only if the bucket policy also denies access.
Why it's wrong here
The IAM policy itself contains an explicit Deny, and that is sufficient to block the request. AWS authorization does not require a bucket policy to also deny access; an explicit deny in any applicable identity-based policy always overrides any allow from resource-based policies. Therefore, the user is denied regardless of what the bucket policy says.
- ✗
The user can download the object because the Deny statement only applies to 's3:*' actions, not s3:GetObject.
Why it's wrong here
The statement 's3:*' is a wildcard that matches every S3 action, including s3:GetObject. In IAM policy evaluation, an action set with a wildcard covers all action strings that begin with the specified prefix. Consequently, the Deny statement explicitly applies to s3:GetObject, and this explicit deny overrides the Allow statement, so the user cannot download the object.
- ✗
The user can download the object because the Allow statement grants s3:GetObject on the bucket.
Why it's wrong here
While the Allow statement does grant s3:GetObject, IAM authorization uses a default-deny model and applies explicit denies with higher precedence. When any statement in an applicable policy explicitly denies the action and resource in question, that deny overrides all allowances, including those from bucket-level allows. As a result, the Allow statement cannot grant access because the explicit Deny takes precedence.
- ✓
The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.
Why this is correct
The policy's Deny statement denies all s3 actions on the ARN arn:aws:s3:::bucket/secret/*, which matches the requested object in the 'secret/' prefix. An explicit deny always overrides any allow, including the separate Allow statement granting s3:GetObject on the bucket. Therefore, the user is denied access to that object, and this is the correct interpretation of the policy evaluation outcome.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.