SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Deny",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/confidential/*"
        }
    ]
}

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Access is denied because the Deny statement explicitly matches the resource.

An explicit Deny statement overrides any Allow. The policy denies access to objects in the 'confidential' folder, so the user will be denied access to 'report.pdf'. Option B is wrong because even though the Allow statement exists, the explicit Deny takes precedence. Option C is wrong because the Deny is explicit and does not require other policies. Option D is wrong because the broader Allow does not override the explicit Deny.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Access is denied because the Deny statement explicitly matches the resource.
Why this is correct
An explicit Deny always overrides an Allow.
✗
Access is allowed because the Deny statement is not evaluated.
Why it's wrong here
All statements are evaluated; Deny takes precedence.
✗
Access is denied only if the user is not authorized by other policies.
Why it's wrong here
The Deny is explicit and applies regardless of other policies.
✗
Access is allowed because the Allow statement is broader.
Why it's wrong here
Explicit Deny overrides Allow.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Design for New Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question