SOA-C02 Reliability and Business Continuity Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
}
]
}
```A SysOps administrator creates the above IAM policy for a user. The user reports that they cannot delete an object in the bucket 'my-bucket' even though they are using MFA. What is the likely cause?
⚠ Common exam trap
Watch out — candidates often confuse 'having MFA enabled on the user account' with 'using MFA in the API call session' — the condition key aws:MultiFactorAuthPresent checks the latter, not the former.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user is not using MFA when making the API call.
The policy requires MFA for all s3:DeleteObject actions, as indicated by the condition key aws:MultiFactorAuthPresent set to 'true'. If the user reports they cannot delete an object despite using MFA, the most likely cause is that they are not actually using MFA when making the API call — for example, they may have authenticated with long-term credentials (access key/secret key) without a multi-factor authentication session. The condition key checks the presence of an MFA-authenticated session token, not just whether the user has MFA enabled on their account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The resource ARN is missing the bucket-level permission.
Why it's wrong here
The resource ARN for S3 object-level actions correctly uses the object wildcard pattern `arn:aws:s3:::bucket-name/*`. Bucket-level permissions are only required for bucket-scoped actions such as `s3:ListBucket` or `s3:GetBucketLocation`, not for deleting an object. Since the policy governs an object operation, the ARN is accurate, and this is not the cause of the access denial.
- ✗
The condition key aws:MultiFactorAuthPresent is incorrectly spelled.
Why it's wrong here
The condition key `aws:MultiFactorAuthPresent` is a valid AWS global condition key, correctly spelled and used to enforce MFA. IAM evaluates this boolean key to `true` when the caller authenticated with an MFA device and `false` otherwise. Therefore, a spelling error is not the issue; the denial stems from the key's evaluated value, not its syntax.
- ✓
The user is not using MFA when making the API call.
Why this is correct
The condition likely sets `aws:MultiFactorAuthPresent` to `false` or uses the `Bool` operator to deny access when MFA is absent. Because the user made the API call without an MFA token, the condition evaluates to `false`, triggering the `Deny` statement. This is the explicit reason why the delete request fails, as the policy mandates MFA for all actions by this user.
- ✗
The policy does not include s3:DeleteObjectVersion.
Why it's wrong here
The action `s3:DeleteObject` is sufficient to delete the current version of an object; `s3:DeleteObjectVersion` is only required when deleting a specific version using the `versionId` parameter in a versioned bucket. The policy's omission of the version-specific action does not affect the attempted deletion of the current version. So a missing `s3:DeleteObjectVersion` is not the cause of the denial.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.