DOP-C02 Security and Compliance Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:root"
},
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Read and write objects in the bucket
The policy grants s3:GetObject and s3:PutObject to the root user of the specified account. It does not grant other actions. The resource is objects under my-bucket. The principal is the root user of the other account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the bucket policy
Why it's wrong here
Changing a bucket policy requires the s3:PutBucketPolicy action, which is a bucket-level permission that must be explicitly allowed on the bucket ARN (arn:aws:s3:::bucket). This policy statement only grants s3:GetObject and s3:PutObject on the object ARN (arn:aws:s3:::bucket/*), so it contains no permission to modify the policy document itself. Therefore, this grant to the root principal does not authorize any PutBucketPolicy call, even though the root user may have access through other administrative mechanisms.
- ✗
Delete objects from the bucket
Why it's wrong here
Deleting an object from an S3 bucket requires the s3:DeleteObject action on the specific object ARN. The policy here lists only s3:GetObject and s3:PutObject, with no s3:DeleteObject action anywhere in the statement, so the root principal is not allowed to remove existing objects under this policy. The absence of a delete action means the policy offers no authorization for object removal, regardless of the read and write permissions it does grant.
- ✓
Read and write objects in the bucket
Why this is correct
This policy grants the root principal s3:GetObject and s3:PutObject actions on the arn:aws:s3:::bucket/* resource. s3:GetObject allows downloading an object's data and metadata, while s3:PutObject allows uploading a new object or overwriting an existing one. Together, these actions explicitly authorize reading and writing objects inside the bucket, which is exactly what the question asks — making this the correct option.
- ✗
List objects in the bucket
Why it's wrong here
Listing objects in a bucket requires the s3:ListBucket permission, which is a bucket-level action evaluated against the bucket ARN (arn:aws:s3:::bucket), not against individual object ARNs. The policy only restricts its actions to the object ARN wildcard (arn:aws:s3:::bucket/*) and does not include s3:ListBucket at all. Consequently, the root principal cannot use this policy to enumerate the bucket's object keys or names, since read/write object access does not imply list access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.