MLS-C01 Data Engineering Practice Question

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::data-lake-bucket/*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "s3:*"
      ],
      "Resource": "arn:aws:s3:::data-lake-bucket/sensitive/*",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}

An IAM policy is attached to a group. A user in the group tries to read the object s3://data-lake-bucket/sensitive/file.txt from an IP address 192.168.1.1. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The request is denied because of the Deny statement

The Deny statement explicitly denies any S3 action on the sensitive prefix when the source IP is not from 10.0.0.0/8. Since the IP 192.168.1.1 is not in that range, the Deny applies. Deny statements override Allow statements. So the user is denied access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request is allowed because the Allow statement grants s3:GetObject
Why it's wrong here
Deny overrides Allow.
✗
The request is allowed because the Deny condition does not match
Why it's wrong here
Condition matches: IP not in 10.0.0.0/8.
✓
The request is denied because of the Deny statement
Why this is correct
Deny applies when condition is met.
✗
The request is denied because the policy has no explicit Allow for the sensitive prefix
Why it's wrong here
The Allow is for all objects, but Deny overrides.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Practice tests

Short scored sets — answer, get feedback, read the explanation, move on.

MLS-C01 Exam Simulation 1 — 100 Questions→MLS-C01 Practice Exam 4 — 20 Questions→

Domain-focused practice

Drill one exam section at a time instead of jumping between unrelated topics.

Data Engineering Modeling Exploratory Data Analysis

Filter by question format

Pick a question style and work only that format until it feels routine.

Browse scenarios

Go deeper on a topic

One concept per page — questions, worked explanations, and a short concept guide.

Data Engineering practice questions MLS-C01 scenario practice questions Exploratory Data Analysis practice questions

Keep going

Exam domains AWS Certified Machine Learning Specialty MLS-C01 exam guide Study guide

This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.

MLS-C01 Data Engineering Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question