MLS-C01 s3:GetObject Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::my-bucket/training/*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::my-bucket/training/"
}
]
}
```A data scientist is trying to read a CSV file from S3 bucket 'my-bucket' with key 'training/data.csv' using an IAM role with the attached policy shown in the exhibit. The read operation fails with an Access Denied error. What is the most likely cause?
⚠ Common exam trap
The MLS-C01 exam often tests the nuanced distinction between object-level permissions (GetObject) and bucket-level permissions (ListBucket). A common pitfall is assuming that GetObject alone is sufficient for all read operations, ignoring the fact that many S3 interactions (e.g., via the console or certain SDK methods) implicitly require ListBucket to navigate the bucket hierarchy. This question highlights that even with GetObject allowed, the absence of ListBucket can cause an Access Denied error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include the s3:ListBucket permission, which is required to access the object.
The s3:GetObject permission alone is sufficient for direct object retrieval using the object's full key (e.g., via AWS CLI `aws s3api get-object`). However, many AWS services and tools (such as the S3 console, Amazon Athena, or AWS Glue) implicitly invoke a ListObjects API call to resolve the object path or display the bucket contents, which requires the s3:ListBucket permission. Without it, these operations fail with an Access Denied error even though GetObject is granted. In this scenario, the error likely occurs because the tool or service used to read the file performs a ListObjects call first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy does not include the s3:ListBucket permission, which is required to access the object.
Why this is correct
To read an S3 object, the principal needs both s3:GetObject on the object and s3:ListBucket on the bucket (or at least the bucket-level permission to allow access). The policy only grants object-level permissions, not bucket-level ListBucket.
- ✗
The object is encrypted with SSE-KMS and the role does not have kms:Decrypt permission.
Why it's wrong here
The error message is Access Denied, not a KMS-related error. If KMS was the issue, the error would mention KMS.
- ✗
The resource ARN in the first statement should be 'arn:aws:s3:::my-bucket/training' without the wildcard.
Why it's wrong here
The resource ARN 'arn:aws:s3:::my-bucket/training/*' is correct for granting access to all objects under the 'training/' prefix.
- ✗
The policy explicitly denies s3:GetObject because of the second statement with the trailing slash.
Why it's wrong here
The second statement grants s3:GetObject on a resource that ends with a trailing slash, which is invalid for objects, but it does not deny access. The first statement still grants s3:GetObject on 'training/*'.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.