MLS-C01 Data Engineering Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/raw/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/processed/*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to a data engineering role. The role is used by an AWS Glue ETL job that reads from 'raw/' and writes to 'processed/'. The job fails with an access denied error when trying to write to 'processed/'. What is the likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Deny statement on s3:DeleteObject prevents overwriting objects.

The Deny statement on s3:DeleteObject explicitly denies the permission required to overwrite an existing object in S3. When an AWS Glue job writes to 'processed/' and attempts to overwrite an existing object, S3 requires both s3:PutObject and s3:DeleteObject permissions (since overwrite involves delete then put). The Deny on DeleteObject causes the access denied error. Option B is incorrect because the role is presumed to be attached correctly per the scenario. Option C is incorrect because the policy allows both GetObject and PutObject on the same resource, as is typical. Option D is incorrect because the ARN for the 'processed' folder is correctly specified; the error is due to the Deny, not incorrect ARN.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The Deny statement on s3:DeleteObject prevents overwriting objects.
Why this is correct
If the job tries to overwrite an existing object, it needs DeleteObject permission.
✗
The role is not correctly attached to the Glue job.
Why it's wrong here
Assume attachment is correct.
✗
The policy does not allow both s3:GetObject and s3:PutObject on the same resource.
Why it's wrong here
The policy allows both on separate resources.
✗
The policy specifies incorrect ARN for the 'processed' folder.
Why it's wrong here
The ARN is correctly specified.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLS-C01 Data Engineering Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question