SCS-C02 Identity and Access Management Practice Question

A security engineer is troubleshooting an issue where an IAM user is unable to list objects in an S3 bucket even though the user has an IAM policy that allows s3:ListBucket. What is the MOST likely cause?

⚠ Common exam trap

The trap is assuming that an IAM allow is sufficient; candidates might overlook the possibility of an explicit deny in a bucket policy, which takes precedence.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The bucket policy explicitly denies the action for that user.

In AWS, an explicit deny in a bucket policy overrides any allow in an IAM policy. Even if the IAM user has s3:ListBucket allowed, if the bucket policy explicitly denies that action for that user, the user will be unable to list objects. This is the most likely cause given the scenario.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user's IAM policy is not attached to the user.
Why it's wrong here
The scenario explicitly states that the IAM policy is attached, so this cannot be the root cause. In IAM, a policy can be attached directly to the user, to an IAM group, or to a role, but the authorization failure here is an explicit deny from the bucket policy rather than a missing identity-based allow. If the policy were truly unattached, the user would also see an Access Denied error, but the root distinction is that the deny exists in the bucket policy, which overrides any allow.
✗
The bucket is in a different AWS region.
Why it's wrong here
S3 bucket locations are region-specific, but IAM permission evaluation is global—a bucket in a different region does not change how S3 authorizes a request. The bucket policy applies to the bucket regardless of which region the IAM user is in, and S3 global endpoints route requests correctly. Only if a policy had a conditional aws:RequestedRegion or aws:ResourceRegion key would region matter, and no such condition is mentioned in the scenario.
✗
The user needs to use MFA.
Why it's wrong here
MFA is only required when a policy explicitly includes a condition like aws:MultiFactorAuthPresent equal to true, and the scenario does not indicate any MFA condition on the IAM policy or bucket policy. Even if MFA were required, the failure would typically occur at the STS credentials step or produce an Access Denied error, not a different behavior than an explicit deny. Since the bucket policy contains an explicit deny, that is the decisive factor, not an MFA requirement.
✓
The bucket policy explicitly denies the action for that user.
Why this is correct
In S3, an explicit deny in a bucket policy takes precedence over any allow from an identity-based IAM policy. When a bucket policy includes a Deny statement that matches the principal, action, and resource, the request is rejected regardless of the user's IAM permissions. This is the most direct and common cause of an Access Denied error when the user's IAM policy already grants the s3:ListBucket action.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Identity and Access Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question