DEA-C01 Data Security and Governance Practice Question
A media company stores video files in an Amazon S3 bucket. The bucket policy allows access only from a specific VPC. The company has enabled S3 Server Access Logs to monitor access. Recently, the security team found that some requests were coming from an IP address outside the allowed VPC. They suspect that the bucket policy may have an incorrect condition. What should they check first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.
The `aws:SourceVpc` condition key is specifically designed to restrict access to requests originating from a specific VPC. If the bucket policy uses `aws:SourceVpce` (for VPC endpoints) or has an incorrect VPC ID, it may allow unintended access. Therefore, verifying the condition key and its value is the first troubleshooting step. Option B is incorrect: while reviewing Server Access Logs can help identify suspicious IPs, the immediate issue is the bucket policy condition misconfiguration; logs are for detection, not root cause verification. Option C is incorrect: IAM role permissions are separate from the bucket policy's condition-based restriction; even with correct IAM permissions, the bucket policy condition could be misconfigured. Option D is incorrect: checking for public access is relevant but not the first step since the policy already uses a VPC-based condition; the specific condition key is the likely problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify that the bucket policy uses the 'aws:SourceVpc' condition key with the correct VPC ID.
Why this is correct
The 'aws:SourceVpc' condition key restricts access to requests originating from the specified VPC.
- ✗
Review the S3 Server Access Logs to identify the source IP addresses.
Why it's wrong here
This identifies the issue but does not fix the condition key mistake.
- ✗
Ensure that the IAM role used by the application has the correct permissions.
Why it's wrong here
The bucket policy condition is the likely misconfiguration.
- ✗
Check if the bucket policy allows public access.
Why it's wrong here
The bucket policy restricts to VPC, but the condition might be incorrect.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.