DVA-C02 - Security (26% of the exam) - Section 2.3

Author and reason about IAM identity-based and resource-based policies, including managed versus customer-managed policies and policy evaluation.

Author IAM identity-based and resource-based policies using JSON policy documents, and reason through the policy evaluation logic to predict whether an action will be allowed or denied. Distinguish AWS managed policies from customer-managed policies and apply least privilege to constrain application permissions.

IAM policy evaluationResource-based policiesManaged policiesLeast privilege

Practice question for this objective

Free sampleSecurityhard

A developer is reasoning about how AWS evaluates a single same-account API request against an IAM identity-based policy on the calling role and a resource-based policy on the target resource. Which TWO statements correctly describe AWS IAM policy evaluation logic for that request? (Select TWO.)

AAn explicit Deny in either the identity-based policy or the resource-based policy overrides any Allow and denies the request. Correct
BWithin the same account, an Allow in the resource-based policy alone is sufficient even if no identity-based policy allows the action. Correct
CIf neither policy contains a matching Allow or Deny, the request is permitted because the account owns both the principal and the resource.
DThe identity-based policy Allow is ignored whenever a resource-based policy is present, which always takes precedence.
EA resource-based policy can only narrow permissions granted by an identity-based policy, never grant new access on its own.

An explicit Deny in any policy overrides every Allow, and for same-account access an Allow in either the identity-based or resource-based policy grants the action. AWS starts every request at an implicit deny, then collects all applicable policies. Any explicit Deny is final. For same-account requests an Allow in either the principal's identity-based policy or the resource-based policy is enough; the two are evaluated together rather than one overriding the other.

Why A is correct: Correct: an explicit Deny in any applicable policy always wins over every Allow, so a Deny in either policy blocks the request.

Why B is correct: Correct: for same-account access an Allow in either the identity-based or the resource-based policy grants the action, so a resource-based Allow alone suffices.

Why C is wrong: Tempting because the account owns both, but the default is an implicit deny, so absence of any Allow means the request is denied.

Why D is wrong: Sounds like resource policies dominate, but both policy types are evaluated together; neither blanket-overrides the other except via explicit Deny.

Why E is wrong: This describes a permissions boundary, not a resource-based policy, which can independently grant same-account access by itself.

See more DVA-C02 practice questions, answers explained.

Exam traps in Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the DVA-C02 bank for this domain.

Edit the AmazonS3FullAccess managed policy in place to scope its Resource down to the one bucket, then leave it attached to the role.
Why it is wrong: AWS managed policies are read-only and cannot be edited by customers, so attempting to scope this policy in place is not possible.
Attach the AWS managed policy AmazonEC2FullAccess instead so AWS maintains it and the team stops editing policies.
Why it is wrong: Tempting because AWS maintains it, but it still grants broad ec2:* access and cannot be edited to narrow scope, defeating least privilege.
The call succeeds, because an Allow in the identity-based policy outweighs a Deny that appears in a permissions boundary or service control policy.
Why it is wrong: This assumes Allow can outweigh an explicit Deny, but IAM evaluation never lets an Allow override a Deny in any applicable policy, so the call is denied.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.