ANS-C01 Network Security, Compliance and Governance Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "true"
}
}
}
]
}
```A company applies the above S3 bucket policy. An administrator reports that an application using the AWS SDK is unable to upload objects to the bucket from an EC2 instance in the same account. The EC2 instance has an IAM role with s3:PutObject permission. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is using HTTP instead of HTTPS.
The bucket policy includes a condition 'aws:SecureTransport': 'true', which requires all requests to use HTTPS. If the AWS SDK is configured to use HTTP instead of HTTPS, the request will be denied even though the IAM role has s3:PutObject permission. Option A is incorrect because the bucket policy likely grants access to all users in the account or to the IAM role specifically, not just the root user. Option B is incorrect because server-side encryption is not required by the policy; only HTTPS is enforced. Option C is incorrect because the policy resource typically covers both the bucket and its objects, so access to the bucket is granted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket policy grants access to the root user only, not the IAM role.
Why it's wrong here
The root user represents the account; IAM roles in the same account are under the same root, but the policy does not explicitly allow the role.
- ✗
The application is not using server-side encryption.
Why it's wrong here
The condition does not require encryption; it only requires HTTPS.
- ✗
The bucket policy does not grant access to the bucket itself, only to objects.
Why it's wrong here
The resource includes the bucket and objects; the policy allows PutObject and GetObject on objects.
- ✓
The application is using HTTP instead of HTTPS.
Why this is correct
The condition requires secure transport; HTTP requests are denied.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.