ANS-C01 Network Management and Operations Practice Question
Which TWO configuration steps are required to enable VPC Flow Logs to be published to an S3 bucket in a different AWS account? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.
To publish VPC Flow Logs to an S3 bucket in a different AWS account, two steps are required: (1) Attach a resource-based policy to the destination S3 bucket that grants the source account's Flow Logs service permission to write objects. This is option A. (2) Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject permission to the destination bucket. This is option C. Option B is incorrect because CloudWatch Logs in the source account would not enable cross-account delivery to S3. Option D is incorrect because sharing IAM user access keys is not a secure or supported method for cross-account flow logs. Option E is incorrect because S3 cross-account replication does not enable the Flow Logs service to write to the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach a resource-based policy to the S3 bucket that grants the source account's Flow Logs service permission to write.
Why this is correct
The bucket policy must allow cross-account writes.
- ✗
Configure the Flow Logs destination as a CloudWatch Logs log group in the source account.
Why it's wrong here
The question specifies publishing to S3, not CloudWatch.
- ✓
Create an IAM role in the source account with a trust policy that allows the Flow Logs service to assume it and grants s3:PutObject to the destination bucket.
Why this is correct
This role is necessary for cross-account delivery.
- ✗
Create an IAM user in the source account with programmatic access and share the access keys.
Why it's wrong here
Using programmatic access keys is not a recommended practice for service-to-service permissions.
- ✗
Enable S3 cross-account replication.
Why it's wrong here
Replication is for copying objects after they are written, not for the initial delivery.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.