SAA-C03 Design High-Performing Architectures Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-high-perf-data/*",
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": "vpce-1a2b3c4d"
}
}
}
]
}Refer to the exhibit. A company is using this S3 bucket policy to secure high-performance data accessed by an analytics fleet on EC2. Users report that despite having the correct IAM permissions, they are receiving 403 Forbidden errors when trying to download data. What is the most likely cause of this performance and access issue?
⚠ Common exam trap
SAA-C03 often tests the misconception that 403 Forbidden always means an IAM permission problem, when in fact a bucket policy condition on aws:sourceVpce can deny access even when IAM allows it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instances are not using the specified VPC Endpoint to access S3.
The bucket policy shown in the exhibit restricts access to requests originating from a specific VPC Endpoint (aws:sourceVpce condition). If the EC2 instances are not routing S3 traffic through that endpoint — for example, they are using the public S3 endpoint or a different endpoint — the policy denies the request and S3 returns 403 Forbidden even though the IAM role has s3:GetObject. The fix is to ensure the instances use the specified VPC Endpoint (via route table entries or endpoint policies).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket is in a different region than the EC2 instances.
Why it's wrong here
While cross-region S3 access can increase latency and costs, it would not result in a 403 Forbidden error due to this specific policy unless the VPC Endpoint itself is region-specific. The primary issue here is the logical denial based on the source VPC endpoint ID.
- ✓
The EC2 instances are not using the specified VPC Endpoint to access S3.
Why this is correct
The policy explicitly denies all S3 actions unless the 'aws:sourceVpce' matches 'vpce-1a2b3c4d'. If the EC2 instances are accessing S3 via a NAT Gateway or public internet rather than the specified VPC Endpoint, the condition will trigger a Deny, resulting in the 403 error reported.
- ✗
The IAM role assigned to the EC2 instances lacks S3:GetObject permissions.
Why it's wrong here
The prompt states that users have the 'correct IAM permissions.' Even if IAM permissions were granted, the explicit Deny in the bucket policy for non-matching VPC endpoints would take precedence, making the IAM permissions irrelevant until the networking path is corrected to use the endpoint.
- ✗
The S3 bucket has Object Lock enabled, preventing data retrieval.
Why it's wrong here
S3 Object Lock is used to prevent objects from being deleted or overwritten for a fixed amount of time. It does not prevent users from downloading or reading objects (GetObject). Therefore, Object Lock would not cause a 403 Forbidden error for standard read operations.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.