CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  aws:SourceIp

  Why it's wrong here

  `aws:SourceIp` is a global IAM condition key that compares the requester's IP address to the allowed values in the policy, enabling IP-based allowlists or denylists for API calls. It acts purely at the network layer by inspecting where the request originates, which could be a public IP, a VPC IP, or even a spoofed source—it never inspects whether that connection was encrypted with TLS. A source IP allowlist can restrict who can reach the bucket, but it says nothing about how the data travels, so a user from an approved IP could still send requests via unencrypted HTTP.

  When this WOULD be correct

  A company wants to allow S3 bucket access only from a specific corporate IP range to prevent unauthorized access from outside the network. The bucket policy would use aws:SourceIp to deny requests from IPs outside that range.

• ✗

  aws:Referer

  Why it's wrong here

  `aws:Referer` evaluates the HTTP `Referer` header, which the client sends (often automatically from a browser) to indicate the URL of the page that linked to the request. This condition key is commonly used to prevent hotlinking by limiting access to S3 objects from specific external websites, but the header is trivial to forge or omit and does not represent any security credential or protocol property. It only inspects application-layer metadata about the previous page, not whether the current request was made over HTTPS, so it cannot enforce encryption in transit.

  When this WOULD be correct

  A company wants to restrict access to an S3 bucket so that only requests originating from a specific website (e.g., a corporate web application) are allowed. The administrator would use the aws:Referer condition key to deny requests that do not include the expected Referer header.

• ✓

  aws:SecureTransport

  Why this is correct

  This condition key checks if the request was sent over SSL/TLS. When set to 'false', the condition matches HTTP requests, allowing the policy to deny them. This is the correct key to enforce encryption in transit.

• ✗

  s3:x-amz-server-side-encryption

  Why it's wrong here

  The `s3:x-amz-server-side-encryption` condition key checks the value of the `x-amz-server-side-encryption` header in the request, typically to require AES256 or `aws:kms` encryption for objects as they are written to S3. This enforces encryption at rest—how the object is stored on S3's managed disks—but it does not evaluate the connection between the client and S3. The key inspects a request header, not the TLS state of the transport session, so it cannot prevent data from being sent over plaintext HTTP during the upload.

  When this WOULD be correct

  A company requires that all objects uploaded to an S3 bucket must be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The bucket policy should deny any PutObject request that does not include the x-amz-server-side-encryption header with value aws:kms.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question