A company’s private workload in a VPC uploads objects to an S3 bucket. Security requires that S3 requests are allowed only when they traverse a specific S3 Gateway VPC Endpoint (vpce-0abc123example). Which change best enforces this restriction at the S3 bucket level?

Add an S3 bucket policy Deny statement that blocks requests unless the principal uses MFA.

MFA affects authentication for interactive identity flows. It does not provide any guarantee about the network path or whether the request traversed a specific VPC endpoint, so it cannot enforce the required endpoint-level routing constraint.

Enable Block Public Access and remove the public bucket policy statement.

Block Public Access prevents public exposure of the bucket, but it does not restrict access to a specific VPC endpoint. Private requests from other network locations (that can still reach S3 with valid credentials) would remain possible.

Attach an IAM policy to the workload role that allows s3:PutObject only to the bucket ARN.

Least-privilege IAM limits which actions and resources are permitted, but IAM cannot constrain the origin network path (for example, forcing traffic to traverse vpce-0abc123example). A valid principal could still call S3 from anywhere that has network reachability and credentials.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Add an S3 bucket policy Deny statement for s3:PutObject when aws:sourceVpce is not equal to vpce-0abc123example. — Enforce the approved path at the S3 bucket with a policy condition on aws:sourceVpce. The correct approach is to Deny s3:PutObject (and any other required write actions) unless aws:sourceVpce equals the specific Gateway VPC Endpoint ID. When traffic is routed through that endpoint, AWS includes the endpoint identifier in the request context, allowing the condition to evaluate as intended. If the request reaches S3 through a different path, the condition fails and the Deny applies—preventing writes. IAM permissions alone cannot enforce network-path constraints. MFA controls authentication strength but does not affect whether requests traverse a specified VPC endpoint. Block Public Access mitigates public exposure but does not restrict private network routes to a single endpoint. IAM can restrict permissions to the right bucket/actions, but it cannot ensure the request arrived through vpce-0abc123example; any caller with valid credentials could still reach S3 from other locations.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.