SAP-C02 IAM Policy Evaluation Logic Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

A company applies the above IAM policy to an S3 bucket. An IAM user attempts to upload an object without specifying encryption. Will the upload succeed?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No, because the policy denies the request.

The IAM policy denies the s3:PutObject action when the encryption header is not present or does not match AES256. Since the user did not specify encryption, the condition is triggered, and the request is denied. Options A and B are incorrect because policy evaluation occurs before default encryption is applied and ACL permissions cannot override a deny. Option C is incorrect because the user does not need additional permissions; the policy explicitly denies the request.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Yes, because the user can override the policy with s3:PutObjectAcl.
Why it's wrong here
ACLs do not override IAM policies.
✗
Yes, because the bucket has default encryption enabled.
Why it's wrong here
Policy evaluation occurs before default encryption is applied; the deny overrides.
✗
No, because the user needs additional permissions.
Why it's wrong here
The deny is sufficient to block the request.
✓
No, because the policy denies the request.
Why this is correct
The policy explicitly denies PutObject without AES256 encryption.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on SAP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company applies the above IAM policy to an IAM user. The user attempts to upload an object to my-bucket using the AWS CLI with the command: aws s3 cp file.txt s3://my-bucket/. What is the outcome?

medium

A.The upload fails with an access denied error because the Deny statement is evaluated first.
✓ B.The upload fails with an access denied error because the Deny statement with StringNotEquals blocks the request.
C.The upload succeeds because the Allow statement matches.
D.The upload succeeds because the Deny statement does not apply when no encryption header is present.

Why B: The Deny statement with StringNotEquals on s3:x-amz-server-side-encryption denies any PutObject that does not specify SSE-S3 (AES256). Since the CLI command does not include any encryption header, the Deny condition matches and the request is denied. Option A is incorrect because evaluation order does not matter; an explicit Deny always overrides an Allow. Option C is incorrect because the Allow statement requires encryption, which is not provided. Option D is incorrect because the Deny statement applies precisely when no encryption header is present.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.