DVA-C02 Security Practice Question
A company has an IAM policy that allows access to an S3 bucket only if the request comes from a specific VPC endpoint. The developer notices that requests from an EC2 instance in that VPC are being denied. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume the bucket policy is the only control point and overlook the VPC endpoint policy, which acts as a separate authorization layer that can silently deny requests even when the bucket policy appears correct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC endpoint policy does not allow the required S3 action for the principal
The VPC endpoint policy is an additional layer of access control that can explicitly deny actions even if the bucket policy allows them. If the endpoint policy does not grant the required S3 action (e.g., s3:GetObject) for the IAM principal (the EC2 instance's role), requests will be denied regardless of the bucket policy. This is a common misconfiguration where developers focus only on the bucket policy and overlook the endpoint policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VPC endpoint policy does not allow the required S3 action for the principal
Why this is correct
A VPC endpoint policy acts as an explicit access control layer for requests originating from within your VPC to AWS services like S3. If this policy does not explicitly permit the required S3 action, such as 's3:GetObject', for the requesting principal, it will override any permissions granted by the IAM user/role policy or the S3 bucket policy. This results in an 'Access Denied' error because the request is blocked at the endpoint before reaching the S3 bucket's own policy evaluation.
- ✗
The bucket policy does not have a condition checking aws:SourceVpce
Why it's wrong here
The absence of an 'aws:SourceVpce' condition in the S3 bucket policy does not inherently cause an 'Access Denied' error. If the IAM policy or the VPC endpoint policy is already denying access, the bucket policy's lack of a specific restriction is irrelevant to the denial. An 'Access Denied' message indicates an explicit denial from *some* policy, not merely the absence of a condition that *could* have further restricted access.
- ✗
The route table does not have a route to the S3 endpoint
Why it's wrong here
A missing route in the route table for the S3 Gateway Endpoint would prevent network connectivity between the EC2 instance and the S3 service. This network failure would manifest as a connection timeout or host unreachable error, indicating the request never successfully reached S3 for authorization. An 'Access Denied' response, conversely, signifies that the request *did* reach S3, but was explicitly rejected by an authorization policy.
- ✗
The security group does not allow outbound HTTPS traffic
Why it's wrong here
If the security group associated with the EC2 instance does not permit outbound HTTPS traffic on port 443, the connection attempt to S3 would fail at the network layer. This would typically result in a connection timeout or a 'connection refused' error, as the TCP handshake and TLS negotiation cannot complete. An 'Access Denied' error, however, is an 'application-level' response from the S3 service itself, indicating a successful connection but a failed authorization.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.