SCS-C02 Identity and Access Management Practice Question
A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy does not grant access to the IAM role
The bucket policy does not grant access to the IAM role. For an IAM role used by an EC2 instance to access an S3 bucket, both the IAM policy attached to the role and the bucket policy must allow the action. Even though the IAM policy grants s3:GetObject, the bucket policy must also explicitly grant access to the role principal. Since the bucket policy does not explicitly deny access (option D is false), the lack of an explicit allow in the bucket policy is the most likely cause. Options A and C are incorrect: SCPs would deny at the organization level, and the IAM policy is attached to the role, not the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service control policy (SCP) is denying access
Why it's wrong here
SCPs are not mentioned, and they would deny at the account level.
- ✓
The bucket policy does not grant access to the IAM role
Why this is correct
When using an IAM role, the bucket policy must explicitly allow the role, otherwise the implicit denial applies.
- ✗
The IAM policy is attached to the user instead of the role
Why it's wrong here
The role has the policy attached, so that should work.
- ✗
The bucket has an explicit deny in its policy
Why it's wrong here
The question states the bucket policy does not explicitly deny.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.