DVA-C02 Security Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "192.0.2.0/24"
}
}
}
]
}Refer to the exhibit. An IAM policy is attached to a user. The user reports that they can access objects in the S3 bucket from their office IP address (192.0.2.15) but cannot access from home (203.0.113.5). What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy restricts access based on source IP address.
The correct option is C: the policy restricts access based on source IP address. Since the user can access the S3 bucket from the office IP 192.0.2.15 but not from the home IP 203.0.113.5, the IAM policy most likely includes a Condition element using aws:SourceIp (or NotIpAddress) that allows only the office IP range. Options A, B, and D do not fit: a VPC requirement would not explain why the office IP works, a bucket policy denying the user would block both locations, and a blanket Deny on s3:GetObject would also block access from the office.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy requires requests to originate from a VPC.
Why it's wrong here
A VPC-origin restriction would be enforced using the aws:SourceVpc or aws:SourceVpce condition keys checking against a VPC or VPC endpoint identifier, which is a completely different condition mechanism than an IP-based restriction; nothing in the described policy references VPC identifiers.
- ✗
The bucket policy does not allow the user.
Why it's wrong here
The question states the IAM policy is attached directly to the user, meaning access is being evaluated through an identity-based policy, not a resource-based bucket policy; since no bucket policy is mentioned as being in play, this option introduces a mechanism that isn't the actual cause here.
- ✓
The policy restricts access based on source IP address.
Why this is correct
The policy includes an aws:SourceIp condition scoped to the office IP range (192.0.2.15), so any request originating from a different address, such as the home IP 203.0.113.5, fails the condition evaluation and the Allow statement does not apply, resulting in implicit denial of the request from home.
- ✗
The policy denies all s3:GetObject actions.
Why it's wrong here
A blanket Deny on s3:GetObject would block access from every location including the office, but the user reports successful access from their office IP, which rules out a universal deny; the behavior is location-dependent, pointing to a conditional restriction rather than an outright denial of the action.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.