PAS-C01 Operations and Maintenance Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::sap-backup-bucket/*"
},
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef"
}
]
}
```An SAP administrator created the IAM policy shown for a backup script. The script fails when trying to upload a backup to S3. What is the likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key ARN is malformed; it contains extra characters.
The KMS key ARN in the IAM policy is malformed (contains extra characters). When the backup script attempts to upload to S3 with server-side encryption using KMS (SSE-KMS), S3 needs to decrypt the object using the KMS key. If the key ARN is invalid, the kms:Decrypt permission cannot be evaluated, causing the upload to fail. Option A is incorrect because for PutObject, the resource must be the object ARN (arn:aws:s3:::sap-backup-bucket/*), not the bucket itself. Option B is incorrect because ec2:Describe* actions do not interfere with S3 operations. Option C is incorrect because the s3:* action, while broad, is permitted on the specified objects, and there is no indication of a restrictive bucket policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The resource for S3 should include the bucket itself (arn:aws:s3:::sap-backup-bucket).
Why it's wrong here
PutObject requires object ARN, which is correct.
- ✗
The ec2:Describe* action is not required and causes a conflict.
Why it's wrong here
Unused actions do not cause failures.
- ✗
The s3:* action is too broad and is denied by an S3 bucket policy.
Why it's wrong here
The action is allowed, bucket policy might override but not necessarily.
- ✓
The KMS key ARN is malformed; it contains extra characters.
Why this is correct
The key ARN has a typo with 'a123b4cd56ef' instead of proper format.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.