A security engineer is implementing ABAC to allow only specific principals to put objects in an Amazon S3 bucket. Principals already have Amazon S3 access. The bucket policy should allow s3:PutObject only when the object's Team tag matches the principal’s Team tag. During testing, a principal can still put objects when the tag values do not match. Which combination of factors explains why PutObject succeeds when the tag values differ? (Choose two.)

In AWS IAM, an explicit DENY always overrides an ALLOW. If there is no explicit DENY, an ALLOW from any policy (identity-based or resource-based) will grant access. The principal's identity-based policy granting s3:PutObject without conditions is a correct factor. Since the principal already has S3 access, their identity-based policy likely contains an Allow statement for s3:PutObject. If this Allow has no conditions, it will grant access regardless of the bucket policy's conditions. The S3 bucket's resource policy not including an explicit Deny for s3:PutObject is also a correct factor. If the bucket policy (a type of resource policy) does not explicitly Deny the action when tag values don't match, and the identity-based policy allows it, the action will succeed. The option about the identity-based policy overriding the bucket policy due to an explicit Allow is incorrect because an Allow in an identity policy doesn't inherently override a conditional Deny (implicit or explicit) in a resource policy. The option about the bucket policy not applying to principals in the same zone of trust is incorrect; bucket policies apply to all principals unless explicitly excluded. The option about the S3 bucket’s resource policy not being able to grant actions to the principal is incorrect; resource policies can grant permissions.