The answer is yes, the request will succeed because the explicit deny with condition only blocks HTTP traffic, not HTTPS. In AWS policies, an explicit deny with a condition like `aws:SecureTransport equals false` specifically targets requests that do not use TLS, so a user from the allowed IP range 203.0.113.0/24 making a request over HTTPS is unaffected by that deny statement and is instead permitted by the separate Allow statement. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your ability to evaluate how explicit deny interacts with conditions—a common trap is assuming any explicit deny overrides all allows, but the deny only applies when its condition is met. Remember, explicit deny is not absolute; it only blocks requests that match both the action and the condition. Memory tip: “Deny only denies what it defines—if the condition doesn’t fit, the deny doesn’t hit.”
ANS-C01 Network Security, Compliance and Governance Practice Question
This ANS-C01 practice question tests your understanding of network security, compliance and governance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company attaches the above bucket policy to an S3 bucket. A user from the IP range 203.0.113.0/24 makes a request over HTTPS (TLS) to download an object from the bucket. Will the request succeed?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the request uses HTTPS and comes from the allowed IP range.
Option D is correct because the bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Yes, but only if the request also includes a valid AWS signature.
Why it's wrong here
Signature is not required by the policy.
✗
No, because the Allow statement is overridden by the Deny statement.
Why it's wrong here
The Deny does not apply because its condition is not met.
✗
No, because the Deny statement denies all requests regardless of the condition.
Why it's wrong here
The Deny has a condition that is not met.
✓
Yes, because the request uses HTTPS and comes from the allowed IP range.
Why this is correct
The Deny only blocks non-HTTPS requests, and the Allow permits the IP range.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
AWS often tests the nuance that an explicit Deny only applies when its conditions are fully satisfied, and candidates mistakenly assume any Deny statement automatically blocks all requests regardless of conditions.
Detailed technical explanation
How to think about this question
S3 bucket policies are evaluated with an explicit Deny taking precedence over any Allow, but only when the Deny's condition is met. Here, the Deny uses the aws:SecureTransport condition key with a Bool condition operator set to 'false', meaning it only denies requests that are not using TLS. Requests over HTTPS satisfy the condition (SecureTransport is true), so the Deny does not apply. The Allow statement then grants access based on the source IP range, making the request succeed even without AWS Signature Version 4 authentication.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Network Security, Compliance and Governance — This question tests Network Security, Compliance and Governance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Yes, because the request uses HTTPS and comes from the allowed IP range. — Option D is correct because the bucket policy includes an Allow statement that grants s3:GetObject access to requests coming from the IP range 203.0.113.0/24 over HTTPS (using the aws:SecureTransport condition). The Deny statement only denies requests that do not use HTTPS (i.e., aws:SecureTransport equals false), so a request from the allowed IP range using TLS is not affected by the Deny and is permitted by the Allow statement.
What should I do if I get this ANS-C01 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team has attached the above IAM policy to a user. The user tries to add an inbound rule to a security group that allows traffic from 0.0.0.0/0. The request is denied. However, the user is able to add a rule allowing traffic from 203.0.113.10. Which statement explains this behavior?
medium
A.The Deny statement incorrectly uses the condition ec2:AuthorizeSecurityGroupIngress, which is not a valid condition key, so the Deny is ignored.
B.The Deny statement denies all ec2:AuthorizeSecurityGroupIngress actions, so the user cannot add any inbound rules.
C.The Allow statement allows all ec2:AuthorizeSecurityGroupIngress actions from IPs in 203.0.113.0/24, so the user can add any rule.
✓ D.The Deny statement only denies the action when the CIDR is 0.0.0.0/0, which overrides the Allow for that specific case. For other CIDRs, the Allow applies because the user's source IP is within the allowed range.
Why D: Option B is correct. The Deny statement specifically denies the action ec2:AuthorizeSecurityGroupIngress when the condition is that the CIDR is 0.0.0.0/0. The Allow statement allows the action from source IP 203.0.113.0/24, but the Deny overrides any Allow. However, since the Deny only applies when the CIDR is 0.0.0.0/0, adding a rule from 203.0.113.10 is allowed by the Allow statement (since the user's IP is within 203.0.113.0/24) and not denied. Option A is wrong because the Deny does not block all ingress; it only blocks ingress from 0.0.0.0/0. Option C is wrong because the Deny is for a specific CIDR, not for all. Option D is wrong because the condition is based on the user's source IP, not the CIDR in the rule.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.