Courseiva
Reliability and Business ContinuitymediumMultiple ChoiceObjective-mapped

SOA-C02 Reliability and Business Continuity Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}
```

A SysOps administrator creates the above IAM policy for a user. The user reports that they cannot delete an object in the bucket 'my-bucket' even though they are using MFA. What is the likely cause?

⚠ Common exam trap

Watch out — candidates often confuse 'having MFA enabled on the user account' with 'using MFA in the API call session' — the condition key aws:MultiFactorAuthPresent checks the latter, not the former.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The user is not using MFA when making the API call.

The policy requires MFA for all s3:DeleteObject actions, as indicated by the condition key aws:MultiFactorAuthPresent set to 'true'. If the user reports they cannot delete an object despite using MFA, the most likely cause is that they are not actually using MFA when making the API call — for example, they may have authenticated with long-term credentials (access key/secret key) without a multi-factor authentication session. The condition key checks the presence of an MFA-authenticated session token, not just whether the user has MFA enabled on their account.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The resource ARN is missing the bucket-level permission.

    Why it's wrong here

    The resource ARN for S3 object-level actions correctly uses the object wildcard pattern `arn:aws:s3:::bucket-name/*`. Bucket-level permissions are only required for bucket-scoped actions such as `s3:ListBucket` or `s3:GetBucketLocation`, not for deleting an object. Since the policy governs an object operation, the ARN is accurate, and this is not the cause of the access denial.

  • The condition key aws:MultiFactorAuthPresent is incorrectly spelled.

    Why it's wrong here

    The condition key `aws:MultiFactorAuthPresent` is a valid AWS global condition key, correctly spelled and used to enforce MFA. IAM evaluates this boolean key to `true` when the caller authenticated with an MFA device and `false` otherwise. Therefore, a spelling error is not the issue; the denial stems from the key's evaluated value, not its syntax.

  • The user is not using MFA when making the API call.

    Why this is correct

    The condition likely sets `aws:MultiFactorAuthPresent` to `false` or uses the `Bool` operator to deny access when MFA is absent. Because the user made the API call without an MFA token, the condition evaluates to `false`, triggering the `Deny` statement. This is the explicit reason why the delete request fails, as the policy mandates MFA for all actions by this user.

  • The policy does not include s3:DeleteObjectVersion.

    Why it's wrong here

    The action `s3:DeleteObject` is sufficient to delete the current version of an object; `s3:DeleteObjectVersion` is only required when deleting a specific version using the `versionId` parameter in a versioned bucket. The policy's omission of the version-specific action does not affect the attempted deletion of the current version. So a missing `s3:DeleteObjectVersion` is not the cause of the denial.

Quick reference

AWS S3 Storage Class Comparison

Storage ClassMin DurationRetrievalUse Case
S3 StandardNoneImmediateFrequently accessed data
S3 Standard-IA30 daysImmediateInfrequent access, rapid retrieval
S3 One Zone-IA30 daysImmediateNon-critical infrequent data
S3 Intelligent-TieringNoneImmediate–hoursUnknown or changing access patterns
S3 Glacier Instant90 daysMillisecondsArchive with instant retrieval
S3 Glacier Flexible90 daysMinutes–hoursArchive, flexible retrieval
S3 Glacier Deep Archive180 daysHoursLong-term compliance archive

About these practice questions

One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.