DVA-C02 Development with AWS Services Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-bucket/confidential/*"
}
]
}Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to s3://my-bucket/confidential/report.pdf. What is the outcome?
⚠ Common exam trap
Candidates often assume an Allow statement on the bucket is sufficient for all objects, forgetting that an explicit Deny on a specific prefix takes precedence and blocks the action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The upload fails because the Deny statement explicitly denies access to the confidential prefix.
The IAM policy includes an explicit Deny statement for s3:PutObject on the `confidential` prefix, which overrides any Allow statements. AWS IAM evaluates policies with explicit Denies taking precedence over Allows, so the upload to `s3://my-bucket/confidential/report.pdf` is blocked regardless of the Allow statement on the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The upload succeeds because the Allow statement grants s3:PutObject on the bucket.
Why it's wrong here
While the Allow statement grants s3:PutObject permissions across the entire bucket, AWS IAM policy evaluation logic dictates that an explicit Deny statement always takes precedence. Therefore, despite the general Allow, the specific Deny targeting the confidential prefix overrides it, preventing the upload from succeeding.
- ✗
The upload fails because there is no Allow statement for the confidential prefix.
Why it's wrong here
The premise that there is no Allow statement for the confidential prefix is incorrect; the Allow statement granting s3:PutObject on 'your-bucket/*' inherently includes all prefixes within that bucket, including 'confidential'. The upload fails not due to a lack of permission, but because an explicit Deny statement specifically revokes that access for the confidential prefix, overriding the broader Allow.
- ✓
The upload fails because the Deny statement explicitly denies access to the confidential prefix.
Why this is correct
The upload fails precisely because the IAM policy contains an explicit Deny statement for the s3:PutObject action on resources within the confidential prefix. In AWS IAM policy evaluation, an explicit Deny always overrides any Allow statements that might otherwise grant access, regardless of their scope or specificity. This strict precedence ensures that sensitive operations or resources can be absolutely protected.
- ✗
The upload fails because the policy is malformed.
Why it's wrong here
The policy is syntactically valid JSON and adheres to AWS IAM policy structure, allowing for both Allow and Deny statements to coexist and define permissions. A malformed policy would typically result in an immediate error during policy creation or attachment, preventing it from being evaluated at all. The failure here stems from the policy's content and its evaluation logic, not its format.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.