ANS-C01 Network Security, Compliance and Governance Practice Question
A company has an AWS Lambda function that needs to access an S3 bucket in the same AWS account. The Lambda function is configured to use the VPC default execution role. The S3 bucket policy denies all principals except those explicitly allowed. The Lambda function cannot access the bucket. What should be done to resolve this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket
The Lambda execution role needs an IAM policy that allows s3:GetObject (or appropriate actions) on the S3 bucket. In this scenario, the bucket policy denies all principals except those explicitly allowed. Since the Lambda function is supposed to access the bucket, the bucket policy already explicitly allows the Lambda role. Therefore, only the IAM permission is missing. Adding the IAM policy (Option A) resolves the issue. Option B is wrong because removing the bucket policy would allow all principals, violating the security intent. Option C is wrong because Lambda functions in a VPC do not require internet gateways or public IPs to reach S3, and it does not address permissions. Option D is wrong because a VPC endpoint provides network connectivity but does not grant IAM permissions; the Lambda execution role still needs the IAM policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add an IAM policy to the Lambda execution role that allows s3:GetObject on the bucket
Why this is correct
The Lambda execution role must have the necessary S3 permissions to access the bucket.
- ✗
Remove the bucket policy that denies all principals
Why it's wrong here
The bucket policy can be modified to allow the Lambda role, but removing it entirely may weaken security.
- ✗
Attach an internet gateway to the VPC and a public IP to the Lambda function
Why it's wrong here
Lambda functions in a VPC can access S3 via a VPC endpoint or NAT gateway, not directly via internet gateway.
- ✗
Create a VPC endpoint for S3 and attach it to the Lambda function's VPC
Why it's wrong here
A VPC endpoint provides private connectivity but does not grant permissions.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.