SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline includes a source stage from GitHub and a deploy stage that syncs the S3 bucket. Recently, the deployment has been failing intermittently with the error 'Access Denied' when the pipeline tries to write to the S3 bucket. The bucket policy allows the pipeline's service role to perform s3:PutObject. The service role has the following IAM policy attached: { 'Effect': 'Allow', 'Action': 's3:PutObject', 'Resource': 'arn:aws:s3:::my-bucket/*' }. What is the MOST likely cause of the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket has a bucket policy that denies the pipeline's service role.
The bucket policy can explicitly deny access even if the IAM role attached to the pipeline allows s3:PutObject. Since both policies are evaluated, an explicit deny in the bucket policy overrides any allow. Option A is incorrect because default encryption does not affect IAM permissions. Option B is incorrect because the pipeline uses the service role, not Git credentials; that would affect source stage authentication, not S3 write access. Option C is incorrect because S3 VPC endpoints are for private connectivity, not required for public S3 access via the internet, and an Access Denied error points to a permissions issue, not a network issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket has default encryption enabled.
Why it's wrong here
Default encryption does not cause Access Denied for PutObject.
- ✗
The pipeline is in a VPC without an S3 VPC endpoint.
Why it's wrong here
Access Denied is a permissions issue, not connectivity.
- ✗
The pipeline's source stage is not configured with Git credentials.
Why it's wrong here
Source stage uses HTTPS or OAuth, not for S3 writes.
- ✓
The bucket has a bucket policy that denies the pipeline's service role.
Why this is correct
An explicit deny in the bucket policy overrides the IAM allow.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.