CLF-C02 Cloud Technology and Services Practice Question
A company needs to generate a pre-signed URL to allow a business partner to download a specific S3 object for 24 hours without requiring AWS credentials. Which S3 feature enables this?
⚠ Common exam trap
A common mix-up: candidates confuse pre-signed URLs with bucket policies or ACLs, thinking those can also grant temporary access, but they lack the time-limited, credential-free delegation that pre-signed URLs uniquely provide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 Pre-signed URLs
Pre-signed URLs grant temporary access to a specific S3 object by embedding credentials in a URL signed with the bucket owner's AWS signature. The URL is valid for a specified duration (up to 7 days, here 24 hours) and allows the partner to download the object without having AWS credentials. This is the only S3 feature that provides time-limited, object-specific access without requiring the partner to authenticate with AWS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
S3 Bucket Policy with IP-based restrictions
Why it's wrong here
An S3 Bucket Policy with an IP-based condition can restrict which source IP addresses may call S3 API actions, but it does not authenticate the requester. Any request against that bucket policy must still be signed with valid IAM credentials or be explicitly allowed as anonymous. External partners without AWS identities therefore cannot use it to obtain temporary, credential-free access to a specific object.
- ✗
S3 Access Points
Why it's wrong here
S3 Access Points are bucket-level configurations that let you enforce separate IAM policies, VPC restrictions, and network controls for different workloads. They simplify access management for shared datasets but do not transform an S3 bucket into a mechanism for issuing temporary, credential-free access. All requests through an access point still require authentication and authorization by an IAM principal, so unauthenticated external partners cannot take advantage of them.
- ✓
S3 Pre-signed URLs
Why this is correct
A pre-signed URL works because an authorized IAM principal uses its Signature Version 4 credentials to sign a request for a specific S3 object and includes an expiration timestamp in the URL. Anyone with the URL can download that exact object before the expiry time, without possessing or providing AWS credentials. This is ideal for granting a temporary, single-object download to an external partner because access is automatically revoked when the expiration time passes.
- ✗
S3 Bucket public-read ACL
Why it's wrong here
A public-read ACL grants the 'Everyone' group permanent read access to all objects in the bucket or the object it is applied to, effectively making the data public to anyone on the internet. Unlike a pre-signed URL, this access never expires and is not limited to a single object, so every current and future object in the bucket becomes readable. S3 Block Public Access also discourages and often blocks this configuration, making it a poor choice for controlled temporary sharing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.