SAA-C03 Design Secure Architectures Practice Question

Exhibit

{
  "Records": [
    {
      "eventVersion": "1.08",
      "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDACKCEVSQ6C2EXAMPLE",
        "arn": "arn:aws:iam::123456789012:user/Alice",
        "accountId": "123456789012"
      },
      "eventTime": "2023-10-27T14:30:00Z",
      "eventSource": "s3.amazonaws.com",
      "eventName": "PutObject",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "192.0.2.50",
      "errorCode": "AccessDenied",
      "errorMessage": "Access Denied"
    }
  ]
}

Refer to the exhibit. A security administrator is reviewing a CloudTrail log entry for an 'Access Denied' error. The user 'Alice' is trying to upload a file to an S3 bucket. Alice has an IAM policy that allows 's3:PutObject' on all resources. What is the most likely cause of this error?

⚠ Common exam trap

Candidates often assume that an IAM policy allowing an action is sufficient. They forget that the final authorization decision is the intersection of IAM, SCPs, and resource-based policies like bucket policies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The S3 bucket has a bucket policy with an explicit Deny for Alice or the action.

In AWS, access is determined by the intersection of all applicable policies. Even if Alice has an IAM policy allowing the action, an 'Access Denied' error can occur if there is an explicit 'Deny' in a Service Control Policy (SCP), a bucket policy, or if there is a Permissions Boundary restricting her actions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The S3 bucket has a bucket policy with an explicit Deny for Alice or the action.
Why this is correct
Even though Alice has an identity-based policy allowing 's3:PutObject', an explicit 'Deny' in a resource-based policy (like a bucket policy) always overrides any 'Allow'. This is a common cause of Access Denied errors when multiple layers of security policies are applied to a resource.
✗
Alice is not using an encrypted connection (HTTPS) to upload the file.
Why it's wrong here
While S3 can be configured to require HTTPS via a bucket policy condition, the CloudTrail log shows a general 'Access Denied' error. If HTTPS were the issue, the error would specifically relate to the secure transport condition in the policy, but the log indicates a more fundamental permission failure.
✗
The S3 bucket is located in a different region than the IAM user.
Why it's wrong here
IAM is a global service, and users can access resources in any AWS region provided they have the appropriate permissions. The region of the bucket does not cause an 'Access Denied' error unless there is an explicit policy condition restricting access based on the 'aws:RequestedRegion' key.
✗
Alice's IAM user is missing the 's3:ListBucket' permission.
Why it's wrong here
The 's3:PutObject' action is used to upload objects and does not require 's3:ListBucket' permission to function. 's3:ListBucket' is needed to see the contents of a bucket, but individual object operations are independent, so the lack of listing permissions would not cause a 'PutObject' failure.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

About these practice questions

Courseiva writes every SAA-C03 question from scratch — 149 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.