The answer is that the IAM role lacks a permissions policy allowing s3:ListBucket. This is because bucket policies alone do not grant access to an IAM role principal; the role must also have an attached IAM policy that explicitly permits the S3 action, as AWS requires both the identity-based policy and the resource-based policy to allow the operation. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of the critical interplay between IAM policies and S3 bucket policies—a common trap is assuming a bucket policy with a role ARN in the Principal element is sufficient, but without a matching IAM policy on the role, the request is denied. A helpful memory tip: think of it as a two-key lock—the bucket policy is one key, and the role’s IAM policy is the other; both must turn to open the bucket.
SCS-C02 Identity and Access Management Practice Question
This SCS-C02 practice question tests your understanding of identity and access management. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role does not have a permissions policy that allows s3:ListBucket.
Option A is correct: bucket policies do not grant permissions to IAM role principals unless the role has permission to access S3 via an IAM policy. Option B is false; S3 does not require MFA. Option C is irrelevant. Option D is false; ACLs are not required.
Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The IAM role does not have a permissions policy that allows s3:ListBucket.
Why this is correct
The role needs an IAM policy allowing S3 actions; bucket policy alone may not be sufficient if the role is not authorized.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Standard ACLs match source addresses.
✗
The bucket has an ACL that denies access to the role.
Why it's wrong here
ACLs are legacy; bucket policy is used.
✗
The bucket policy requires MFA, but the role does not enforce MFA.
Why it's wrong here
Not mentioned; bucket policy may not have MFA condition.
✗
The role's trust policy does not allow sts:AssumeRole.
Why it's wrong here
If users can assume the role, trust policy is fine.
Common exam traps
Common exam trap: ACLs stop at the first match
ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.
Detailed technical explanation
How to think about this question
ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.
KKey Concepts to Remember
Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.
TExam Day Tips
→Check inbound versus outbound direction.
→Read the ACL from top to bottom.
→Look for a broader permit or deny above the intended line.
Key takeaway
ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SCS-C02 ACL questions on filtering logic and placement.
Identity and Access Management — This question tests Identity and Access Management — Standard ACLs match source addresses..
What is the correct answer to this question?
The correct answer is: The IAM role does not have a permissions policy that allows s3:ListBucket. — Option A is correct: bucket policies do not grant permissions to IAM role principals unless the role has permission to access S3 via an IAM policy. Option B is false; S3 does not require MFA. Option C is irrelevant. Option D is false; ACLs are not required.
What should I do if I get this SCS-C02 question wrong?
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SCS-C02 ACL questions on filtering logic and placement.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Standard ACLs match source addresses.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. The role is used by an application running on an EC2 instance. The application is unable to access the bucket, but the role can access other resources. What is the most likely cause?
hard
A.A service control policy (SCP) denies access to the bucket
B.The bucket policy denies access to the role
✓ C.The EC2 instance does not have an instance profile associated with the role
D.The role's trust policy does not allow EC2 to assume the role
Why C: Option A is correct because an EC2 instance profile is required to provide the role to the instance. Option B is incorrect because the role can access other resources, so the trust policy is likely correct. Option C is incorrect because the bucket policy is not denying access, it's granting. Option D is incorrect because SCPs are not mentioned.
Variation 2. A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?
medium
A.The bucket is in a different AWS account.
✓ B.The bucket policy denies access to the IAM role.
C.The bucket policy does not explicitly allow the IAM role.
D.The IAM role has an explicit deny statement.
Why B: Option C is correct because S3 bucket policies and IAM policies must both allow access; if either denies, access is denied. Option A is wrong because explicit deny overrides allow, but the bucket policy might not have an explicit deny. Option B is wrong because the bucket policy might not allow the role. Option D is wrong because service control policies apply at organization level, not directly.
Variation 3. A developer needs to access an S3 bucket from an EC2 instance. The developer creates an IAM role with the necessary S3 permissions and attaches it to the instance profile. However, applications running on the instance can still not access the bucket. What is the most likely cause?
hard
A.The IAM role cannot be attached after the EC2 instance is launched.
✓ B.The IAM role is not attached to the EC2 instance's instance profile.
C.The instance metadata service is disabled on the EC2 instance.
D.The S3 bucket policy does not explicitly grant access to the IAM role.
Why B: Option C is correct because the instance profile must be associated with the EC2 instance at launch or by attaching the profile. Option A is wrong because instance metadata is used by the AWS CLI to obtain credentials. Option B is wrong because a bucket policy with a condition for a specific principal is not required. Option D is wrong because the IAM role can be attached to an existing instance via the instance profile.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.