ANS-C01 Network Security, Compliance and Governance Practice Question
A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?
⚠ Common exam trap
AWS often tests the distinction between IAM policies (which control user permissions) and bucket policies (which control resource-based access), leading candidates to incorrectly choose an IAM policy for IP-based restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.
A bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.
Why it's wrong here
This would restrict access to traffic from within the VPC, not the corporate network (unless the corporate network is connected to the VPC via VPN/Direct Connect).
- ✗
Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.
Why it's wrong here
IAM policies cannot restrict access based on source IP for S3 bucket operations; bucket policies are needed for IP-based restrictions.
- ✓
Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.
Why this is correct
A bucket policy with a condition using aws:SourceIp can restrict access to the corporate IP range. Requiring HTTPS ensures encryption in transit.
- ✗
Enable CloudFront with geographic restrictions and use HTTPS.
Why it's wrong here
Geographic restrictions are based on country, not specific IP ranges.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.