ANS-C01 Network Design Practice Question
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowVPCEConnection",
"Effect": "Allow",
"Principal": "*",
"Action": "ec2:AcceptVpcEndpointConnections",
"Resource": "arn:aws:ec2:us-east-1:123456789012:vpc-endpoint/*",
"Condition": {
"StringEquals": {
"aws:SourceArn": "arn:aws:ec2:us-east-1:111111111111:vpc-endpoint/vpce-abc123"
}
}
}
]
}
```A Network Engineer is troubleshooting a cross-account VPC endpoint connection. The service provider account (123456789012) has the above IAM policy attached to the endpoint service. The consumer account (111111111111) has created a VPC endpoint (vpce-abc123) and is trying to accept the connection. The consumer receives an 'AccessDenied' error when calling ec2:AcceptVpcEndpointConnections. What is the MOST likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that the consumer can accept its own VPC endpoint connection, but in reality, only the service provider account has permission to call AcceptVpcEndpointConnections, regardless of IAM policies attached to the consumer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The consumer account does not have permission to accept the connection; only the service provider can accept.
The 'AccessDenied' error occurs because the consumer account (111111111111) is attempting to call ec2:AcceptVpcEndpointConnections, which is an API action that only the service provider account (123456789012) can perform. The IAM policy shown is attached to the endpoint service in the provider account, but the consumer does not have permission to accept its own connection; instead, the provider must accept the endpoint connection request. This is a fundamental AWS VPC endpoint service behavior where the provider controls acceptance, not the consumer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy action should be 'ec2:CreateVpcEndpoint' instead.
Why it's wrong here
CreateVpcEndpoint is for creating endpoints, not accepting connections.
- ✗
The policy condition 'aws:SourceArn' does not match the consumer's endpoint ARN.
Why it's wrong here
The condition matches the consumer's endpoint, but the issue is not about matching.
- ✗
The policy resource ARN is incorrect; it should be the endpoint service ARN.
Why it's wrong here
The resource is for the VPC endpoint, but the action is performed by the provider, so the resource should be the endpoint service? Actually, the action AcceptVpcEndpointConnections is on the endpoint service, not the endpoint. The resource should be the endpoint service. However, the error is likely due to permissions, not resource. But the most direct cause is that the consumer cannot accept; the provider must accept.
- ✓
The consumer account does not have permission to accept the connection; only the service provider can accept.
Why this is correct
The AcceptVpcEndpointConnections API is called by the service provider, not the consumer. The consumer must wait for the provider to accept.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.