DOP-C02 Security and Compliance Practice Question
A DevOps engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role attached with a policy that allows s3:GetObject. The S3 bucket policy explicitly denies access to the instance's role. What is the result?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access is denied because the bucket policy explicitly denies
An explicit deny in any policy overrides any allow. The bucket policy deny takes precedence over the IAM role allow, so access is denied. Evaluation logic is that an explicit deny prevents access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access is denied only if the bucket is encrypted
Why it's wrong here
Denying access based on encryption is incorrect because S3 bucket encryption using SSE-S3, SSE-KMS, or SSE-C does not participate in IAM or bucket policy authorization decisions. Encryption only governs how the object is stored and decrypted, not whether a principal has permission to read it. The access failure here is caused by the bucket policy's explicit deny, which is evaluated independently of any encryption settings on the object or bucket.
- ✗
Access is allowed only if the instance is in the same region
Why it's wrong here
The AWS region where the EC2 instance runs has no bearing on S3 authorization for this scenario. S3 is a regional service with a global namespace, and IAM policy evaluation does not inspect the requester's region unless a condition key like aws:SourceIp or aws:SourceVpce explicitly references it. Region mismatch cannot grant access, and it certainly cannot override an explicit deny in the bucket policy. The denial is logic-driven, not topology-driven.
- ✗
Access is allowed because the IAM role allows it
Why it's wrong here
The IAM role attached to the EC2 instance indeed grants an allow for the S3 action, but IAM authorization is not an additive union where any single allow wins. AWS evaluates all applicable policies together, and an explicit deny in any policy—including a resource-based bucket policy—immediately overrides every allow from any other policy. This is why the instance receives AccessDenied despite having a valid IAM role permit; the deny has priority.
- ✓
Access is denied because the bucket policy explicitly denies
Why this is correct
The bucket policy contains an explicit deny statement for the principal or action being attempted, and AWS IAM policy evaluation gives explicit deny statements absolute precedence over any allow statements from identity-based policies, resource-based policies, or permission boundaries. Even though the IAM role allows the s3:GetObject call, the explicit deny in the bucket policy forces the final decision to AccessDenied. This precedence is a deterministic, non-configurable part of AWS's authorization engine.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.