ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application stores files in an S3 bucket. The security team wants to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. They have created an IAM role for the EC2 instances with a policy that grants s3:PutObject and s3:GetObject on the specific bucket. They have also attached a VPC endpoint for S3 to the VPC and added a bucket policy that allows access only from the VPC endpoint. Despite this, the EC2 instances can still access other S3 buckets. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC endpoint policy does not restrict access to the specific S3 bucket.
The most likely reason is that the VPC endpoint policy is not restricting access to the specific S3 bucket (Option C). Even though the IAM role only grants permissions on the specific bucket, the VPC endpoint policy defaults to allowing access to all S3 resources. Without a restrictive endpoint policy, the EC2 instances can access other S3 buckets if they have any IAM permissions that allow it (e.g., from another attached policy). Option A is incorrect because the VPC endpoint does not require a route table association to function; rather, the route table must have a route pointing to the endpoint for traffic to use it. Option B is incorrect because the security group on the endpoint controls network traffic, not access to S3 buckets. Option D is incorrect because the IAM role must have a trust policy allowing EC2 to assume it, but that is a prerequisite and would not cause the described issue by itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC endpoint does not have a route table associated with the private subnets.
Why it's wrong here
Without association, traffic would not use the endpoint, but IAM policy still restricts access to the specific bucket.
- ✗
The security group on the VPC endpoint is allowing all traffic.
Why it's wrong here
Security groups control network traffic, not S3 bucket access.
- ✓
The VPC endpoint policy does not restrict access to the specific S3 bucket.
Why this is correct
Without a restrictive endpoint policy, the VPC endpoint allows access to any S3 bucket, and if the instances have any other IAM policies (even default), they could access other buckets.
- ✗
The IAM role does not have a trust policy that allows EC2 to assume it.
Why it's wrong here
If the role were not assumed, the instances would have no permissions at all.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.