SAP-C02 Practice Question: Accelerate Workload Migration and Modernization
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-bucket/secret/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "10.0.0.0/8"
}
}
}
]
}
```Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to `s3://my-bucket/secret/data.txt` from an IP address in the 10.0.0.0/8 range. What will happen?
⚠ Common exam trap
The trap is assuming Allow wins because it appears first or because the user 'has permission' — candidates forget that in AWS IAM, an explicit Deny always overrides any Allow, and they must check the Deny's conditions (prefix + IP range) against the request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The upload fails because the Deny statement explicitly denies s3:PutObject for the prefix secret/ from the specified IP range.
In IAM policy evaluation, an explicit Deny always overrides any Allow. The Deny statement in the policy explicitly denies s3:PutObject for objects under the secret/ prefix when the request originates from the 10.0.0.0/8 range. Since the user is uploading to s3://my-bucket/secret/data.txt from an IP in that range, the Deny matches and the upload fails regardless of the Allow statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The upload succeeds because the Allow statement grants s3:PutObject.
Why it's wrong here
An explicit Deny in the policy overrides the Allow statement, so the request is refused despite s3:PutObject being granted. It is tempting because the Allow does name PutObject, but IAM evaluates explicit Deny first, and the IP condition matches the 10.0.0.0/8 source.
- ✗
The upload succeeds because the Deny statement only applies to GetObject, not PutObject.
Why it's wrong here
The Deny statement's condition and action determine scope; if it targets s3:PutObject on that prefix, the upload is blocked regardless of the GetObject wording. It is tempting to read the Deny as GetObject-only, but explicit Deny overrides any Allow for the matched action.
- ✗
The upload fails because the Deny statement denies all s3 actions unconditionally.
Why it's wrong here
The Deny statement is scoped by a Condition on aws:SourceIp, so it only applies to requests from outside 10.0.0.0/8; from within that range the Deny does not match, so the upload succeeds. It is tempting because an unconditional Deny would indeed override any Allow, which is how explicit denies work.
- ✓
The upload fails because the Deny statement explicitly denies s3:PutObject for the prefix secret/ from the specified IP range.
Why this is correct
An explicit Deny in IAM always overrides any Allow, regardless of other policies. The Deny statement targets s3:PutObject on the secret/ prefix and matches the request's source IP within 10.0.0.0/8, so the upload is blocked.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.