SCS-C02 Identity and Access Management Practice Question
A company has an IAM policy that allows s3:GetObject on all buckets. However, a specific S3 bucket policy explicitly denies s3:GetObject to all principals. An IAM user with the IAM policy tries to read an object from that bucket. What is the result?
⚠ Common exam trap
It's easy for candidates to assume an identity-based allow (IAM policy) can override a resource-based deny (bucket policy), but AWS explicitly prioritizes denies over allows across all policy types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.
D is correct because AWS IAM policy evaluation logic follows an explicit deny override: any explicit deny in any applicable policy (resource-based or identity-based) overrides any allow. The S3 bucket policy explicitly denies s3:GetObject to all principals, so even though the IAM policy allows the action, the explicit deny takes precedence, resulting in a denied request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The request is allowed because the IAM policy is more specific.
Why it's wrong here
Although the IAM policy may appear more specific by targeting a particular bucket action, AWS policy evaluation does not prioritize policies by specificity. Instead, an explicit deny found in any applicable policy—including a resource-based bucket policy—takes absolute precedence over any allow. Consequently, the explicit deny in the bucket policy overrides the IAM allow, so the request is denied, not allowed.
- ✗
The request is allowed because the IAM policy allows the action.
Why it's wrong here
It is true that the IAM policy grants s3:GetObject, but authorization in AWS requires evaluating the identity-based policy and the resource-based bucket policy together. The bucket policy's explicit deny for this action is evaluated during that combined evaluation and overrides the IAM allow. Since an explicit deny cannot be superseded by any allow, the request is ultimately denied, not allowed.
- ✗
The request is denied because the bucket policy applies only to IAM users.
Why it's wrong here
The premise of this option is incorrect because bucket policies are resource-based policies that apply to any principal listed in the statement, including IAM users, roles, or external entities. A bucket policy does not limit its effect to only certain principal types; rather, it specifies which principals are allowed or denied. The actual denial here stems from the explicit deny statement in the bucket policy, not from any restriction that the policy applies only to IAM users.
- ✓
The request is denied because the explicit deny in the bucket policy overrides the allow in the IAM policy.
Why this is correct
This is correct because AWS IAM policy evaluation uses a single decision tree in which any explicit deny overrides all allow statements, regardless of where those allows originate. The IAM policy allows s3:GetObject, but the bucket policy contains an explicit deny for the same action and principal. That explicit deny takes precedence, causing the request to be denied. This fundamental rule ensures that explicit deny statements are always authoritative over allows.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.