SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?
⚠ Common exam trap
Many exam-takers confuse `aws:SourceVpc` (which restricts to an entire VPC) with `aws:SourceVpce` (which restricts to a specific VPC Endpoint), leading them to incorrectly choose Option B (S3 access point) or a generic allow policy, missing the precise VPCE-level control required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.
Using a bucket policy with a condition key like `aws:SourceVpce` allows you to restrict access to only requests originating from a specific VPC Endpoint (VPCE). This ensures that even if the SIEM tool has valid credentials, it can only read the VPC Flow Logs from the S3 bucket when the traffic comes through the designated VPCE, meeting the security team's requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow s3:GetObject to the SIEM's IAM role.
Why it's wrong here
This would allow access from anywhere the role is assumed, not just the VPCE.
- ✗
Use an S3 access point with a network origin policy.
Why it's wrong here
Access points can restrict by VPC, but not specifically by VPCE.
- ✓
Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.
Why this is correct
This condition explicitly restricts access to requests originating from the specific VPCE.
- ✗
Allow s3:GetObject to the SIEM's AWS account ID.
Why it's wrong here
This would allow access from any resource in the SIEM account.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.