SAA-C03 Design Secure Architectures Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::finance-reports/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        },
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

Refer to the exhibit. A company has applied the following bucket policy to an S3 bucket named 'finance-reports'. A user is attempting to download a file from this bucket from the IP address 203.0.113.15 using an authenticated session without MFA. What will be the result of this request?

⚠ Common exam trap

SAA-C03 often tests whether candidates understand that multiple conditions in a single S3 policy statement are ANDed, not ORed — candidates incorrectly assume satisfying one condition is enough.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The request will be denied because both conditions must be true for the policy to grant access.

S3 bucket policy conditions are evaluated with AND logic by default — all conditions in a single Condition block must be true for the statement to apply. Since the request comes from an allowed IP but lacks MFA authentication, the Bool condition (aws:MultiFactorAuthPresent = true) fails, so the policy does not grant access and the request is denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request will be allowed because the IP address is within the allowed range.
Why it's wrong here
Access is not granted solely based on the IP address. The policy contains two conditions that must both be satisfied for the 'Allow' statement to apply. Since the MFA condition is not met, the policy does not grant the necessary permission to the user for this request.
✓
The request will be denied because both conditions must be true for the policy to grant access.
Why this is correct
In AWS policy evaluation, multiple conditions within a single statement are evaluated using a logical AND. The user has the correct source IP, but because they did not authenticate with Multi-Factor Authentication, the second condition fails, and the permission is not granted to the user.
✗
The request will be allowed because the 'Bool' condition is only evaluated if MFA is configured.
Why it's wrong here
The 'aws:MultiFactorAuthPresent' key checks whether MFA was used during the authentication process. If the session does not include MFA, the key evaluates to false. It is not dependent on whether the user has MFA configured on their account, but rather if it was used.
✗
The request will be denied because S3 bucket policies require an explicit 'Deny' statement to block traffic.
Why it's wrong here
AWS follows a 'default deny' logic where access is restricted unless an explicit 'Allow' exists. While an explicit 'Deny' would override an 'Allow', the absence of a successful 'Allow' (due to failed conditions) is sufficient to result in the request being denied by the system.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

About these practice questions

Courseiva writes every SAA-C03 question from scratch — 149 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.