DOP-C02 Incident and Event Response Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::example-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}
```An IAM policy attached to a user is shown in the exhibit. The user reports that they are unable to delete an object in the 'example-bucket' bucket. What is the reason for this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The explicit Deny statement overrides the Allow
An explicit Deny overrides any Allow. The Deny action s3:DeleteObject explicitly denies the delete, even though the Allow all s3 actions includes delete. Option A is wrong because the resource ARN matches. Option C is wrong because the policy allows all s3 actions, but the Deny blocks delete. Option D is wrong because the policy is valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The resource ARN does not match the bucket name
Why it's wrong here
This option is incorrect because the ARN in the policy statement is correctly constructed: bucket-level operations use `arn:aws:s3:::bucketname` and object-level operations use `arn:aws:s3:::bucketname/*`. In the exhibit, the ARN exactly matches the target bucket and its objects, so there is no mismatch. A resource ARN mismatch would cause the action to simply not apply to the intended resource, but here the explicit Deny is the actual blocking factor.
- ✓
The explicit Deny statement overrides the Allow
Why this is correct
This is the correct explanation. AWS IAM policy evaluation is based on a strict rule: an explicit deny from any applicable policy always overrides any allow, regardless of statement order or the number of allows. Even though the policy contains an Allow that includes `s3:DeleteObject` on the specified bucket and objects, the explicit Deny for the same action takes precedence, resulting in the user being denied. This is fundamental to AWS's default-deny model and is non-negotiable.
- ✗
The user does not have permissions to perform s3:DeleteObject
Why it's wrong here
This option is wrong because the accompanying Allow statement explicitly grants `s3:DeleteObject` on the specified bucket and its objects, so the user does have permission in the sense of an allowed action. The problem is not a lack of permission; rather, the user's access is blocked by the separate Deny statement that overrides that grant. A more accurate phrasing would be that the user lacks effective permission due to the deny, but they do have an explicit allow.
- ✗
The policy has a syntax error
Why it's wrong here
This is incorrect because the policy shown is a syntactically valid IAM policy: it is well-formed JSON with a valid Sid, Effect, Action, and Resource, and it passes IAM validation. If it contained a syntax error, AWS would reject it at creation time, and the user would encounter a different error rather than a permission denial. The conflict between the Allow and Deny is a semantic issue, not a syntax issue.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.