SCS-C03 Identity and Access Management Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-secure-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-secure-bucket/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "aws:kms"
}
}
}
]
}Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The explicit Deny statement takes precedence because the upload request does not include the required KMS encryption header.
This question tests the understanding of IAM policy evaluation logic, specifically the explicit deny rule. Even if an allow statement exists, any matching deny statement will take precedence. In this scenario, the user is restricted from uploading objects unless they specify KMS encryption, which is a common requirement for maintaining data security standards within a bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket lacks a bucket policy that explicitly allows the PutObject action for the developer.
Why it's wrong here
While a bucket policy can grant access, the IAM policy shown already includes an 'Allow' for all S3 actions. The failure is not due to a lack of permission but rather the presence of an explicit 'Deny' statement that overrides the general 'Allow' when specific conditions are not met.
- ✓
The explicit Deny statement takes precedence because the upload request does not include the required KMS encryption header.
Why this is correct
In AWS IAM, an explicit deny always overrides an allow. The policy denies 'PutObject' if the encryption header is not 'aws:kms'. Since the developer did not specify encryption, the condition evaluates to true for the deny statement, resulting in an Access Denied error for the operation.
- ✗
The developer's IAM user does not have the 'kms:GenerateDataKey' permission required to encrypt the object.
Why it's wrong here
The error described is 'Access Denied' from S3 based on the policy evaluation, not a KMS error. While the developer would eventually need KMS permissions to complete the upload with encryption, the immediate failure is caused by the S3 policy condition rejecting the request before KMS is even invoked.
- ✗
The resource ARN in the policy is incorrect because it should include the bucket name without the trailing slash.
Why it's wrong here
The resource 'arn:aws:s3:::my-secure-bucket/*' is correct for object-level operations like 'PutObject'. Removing the trailing slash and asterisk would refer to the bucket itself rather than the objects within it, which is not the issue here as the policy correctly targets the objects for the upload action.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.