MLS-C01 Data Engineering Practice Question
Network Topology
A data engineer runs the CLI command to download an object from S3. The bucket owner is 123456789012, and the engineer's IAM user has s3:GetObject permission on the bucket. The object was uploaded by a different AWS account. What is the MOST likely reason for the AccessDenied error?
⚠ Common exam trap
It's easy for candidates to assume bucket-level permissions (like s3:GetObject on the bucket) automatically grant access to all objects in the bucket, but S3's object ownership model requires explicit permission from the object owner for objects uploaded by other accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The object is owned by a different AWS account, and the bucket owner has not been granted access
When an object is uploaded to S3 by a different AWS account, the object is owned by the uploading account, not the bucket owner. By default, the bucket owner does not have access to objects uploaded by other accounts, even if the bucket owner has a policy granting s3:GetObject to their IAM users. The engineer's IAM user has permission on the bucket, but the object itself is not owned by the bucket owner, so the bucket owner cannot delegate access to it unless the object owner explicitly grants read access via an object ACL or a bucket policy that the object owner accepts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The --expected-bucket-owner parameter is incorrect
Why it's wrong here
The parameter is for bucket owner, not object owner.
- ✓
The object is owned by a different AWS account, and the bucket owner has not been granted access
Why this is correct
Object ACLs or bucket policy must grant access to bucket owner.
- ✗
The bucket policy denies access to the engineer's IAM user
Why it's wrong here
There is no indication of a Deny.
- ✗
The IAM policy does not allow s3:GetObject for that specific key
Why it's wrong here
The policy allows GetObject on the bucket, but object ownership matters.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.