DOP-C02 Security and Compliance Practice Question

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonHTTPS",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

An S3 bucket has the above bucket policy. What is the effect of this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It denies access to the bucket if the request is not sent over HTTPS

The bucket policy denies all S3 actions when the request is not sent over HTTPS (i.e., when aws:SecureTransport is false). Therefore, the policy enforces HTTPS for all access to the bucket. Option C correctly states this effect. Option A is incorrect because the policy does not allow anonymous access; it only denies non-HTTPS requests. Option B is incorrect because the policy does not deny all access; it only denies requests that are not HTTPS. Option D is incorrect because the policy does not reference IP addresses.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It allows anonymous access to the bucket over HTTPS
Why it's wrong here
This policy does not grant any permissions. An S3 bucket policy that only contains a Deny statement can never allow anonymous (or authenticated) users to access the bucket, regardless of whether the request uses HTTPS. Even for HTTPS requests, this statement simply does not apply because the condition requires SecureTransport to be false; any actual access would still need a separate Allow statement (or bucket policy/ACL) granting the principal permission. Therefore, this incorrectly characterizes the effect as an allowance.
✗
It denies all access to the bucket regardless of protocol
Why it's wrong here
The Deny in this policy is conditional on aws:SecureTransport being false. When a request arrives over HTTPS, SecureTransport is true, so the condition evaluates to false and the Deny statement does not match — it has no effect on that request. Thus the policy only blocks requests that use plain HTTP; it does not deny all access to the bucket. Access is not universal denial, but a protocol-specific restriction.
✓
It denies access to the bucket if the request is not sent over HTTPS
Why this is correct
This statement uses 'Deny' with the condition 'aws:SecureTransport': 'false', meaning that any time S3 sees a request to this bucket that did not use TLS/SSL, the condition is satisfied and the explicit deny applies, causing the request to be rejected. HTTPS requests have SecureTransport set to true, so they are not affected by this particular statement and may be allowed or denied based on other applicable policies. This is a standard pattern to enforce HTTPS-only access to S3 buckets.
✗
It allows access only from specific IP addresses
Why it's wrong here
There is no aws:SourceIp, aws:SourceVpc, or any network-origin condition in this policy. The only condition key present is aws:SecureTransport, which deals exclusively with encryption in transit, not client IP addresses. Furthermore, as a Deny statement, it cannot grant or 'allow' access to certain IPs; it can only restrict. Claims about IP-based allowances are therefore unsupported by this bucket policy.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DOP-C02 Security and Compliance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question