DOP-C02 Security and Compliance Practice Question
A DevOps engineer manages a fleet of EC2 instances in a private subnet. The instances must access an Amazon S3 bucket to read configuration files. The security team requires that all traffic to S3 be encrypted in transit and that the EC2 instances do not use the public internet. The engineer has already created an S3 gateway endpoint and attached it to the VPC route table. Which additional step should the engineer take to meet these requirements?
⚠ Common exam trap
The trap here is assuming that a VPC gateway endpoint automatically encrypts traffic to S3, when it only provides private routing and still allows unencrypted HTTP requests unless a bucket policy enforces secure transport.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the S3 bucket policy to deny requests where aws:SecureTransport is false.
The gateway endpoint provides private network routing, but encryption in transit must be enforced separately. A bucket policy that denies requests when aws:SecureTransport is false ensures that only HTTPS requests are allowed, satisfying the encryption requirement. IAM roles handle authorization, interface endpoints are an alternative connectivity method, and default encryption addresses data at rest, not in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the S3 bucket policy to deny requests where aws:SecureTransport is false.
Why this is correct
Adding a bucket policy that denies requests when aws:SecureTransport is false enforces HTTPS for all access to the bucket. Combined with the gateway endpoint, traffic stays within the AWS network and is encrypted in transit. This directly meets both the encryption and private connectivity requirements.
- ✗
Configure the EC2 instances to use an S3 interface endpoint instead of the gateway endpoint.
Why it's wrong here
An interface endpoint (AWS PrivateLink) also provides private connectivity to S3, but it is not required here because a gateway endpoint already handles routing. Switching to an interface endpoint adds cost and complexity without enforcing encryption in transit. The requirement for encrypted traffic still needs a bucket policy or similar control.
- ✗
Attach an IAM role to the EC2 instances that allows s3:GetObject on the bucket.
Why it's wrong here
An IAM role provides authorization but does not enforce encryption in transit or prevent public internet access. The gateway endpoint already routes traffic privately, but without a bucket policy requiring aws:SecureTransport, the data could be accessed over HTTP. This step alone does not satisfy the encryption requirement.
- ✗
Enable default encryption on the S3 bucket using AES-256.
Why it's wrong here
Default encryption protects data at rest, not in transit. The scenario specifically requires encryption in transit between the EC2 instances and S3. While server-side encryption is a good practice, it does not prevent unencrypted HTTP requests from reaching the bucket, so it fails to meet the stated requirement.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.