hardMultiple ChoiceObjective-mapped
SSCP Explicit Deny Practice Question
Exhibit
Refer to the exhibit. The following IAM policy is attached to a user:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::corporate-data/*"
},
{
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::corporate-data/*"
}
]
}Based on the exhibit, if the user attempts to upload (write) a file to the shared data repository corporate-data, what is the result?
⚠ Common exam trap
It's easy for candidates to assume an explicit allow for write would override a deny, but in access control policies, an explicit deny always wins, making the presence of any deny statement the decisive factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denied because the explicit deny overrides any allow
The resource's access control policy includes an explicit deny statement that denies write permission for the user's principal. In standard access control policy evaluation, an explicit deny always overrides any allow, regardless of other permissions. Therefore, even if other statements allow write access, the explicit deny blocks the upload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allowed because the access policy likely allows public writes
Why it's wrong here
Allowed because the resource policy likely allows public uploads
- ✓
Denied because the explicit deny overrides any allow
Why this is correct
Denied because the explicit deny overrides any allow
- ✗
Denied because write permission is not explicitly allowed
Why it's wrong here
Denied because upload is not explicitly allowed
- ✗
Allowed because the policy also allows read access
Why it's wrong here
Allowed because the policy also allows read access
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.