SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceVpce": "vpce-12345678"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

⚠ Common exam trap

Candidates often confuse encryption in transit (HTTPS) with encryption at rest (SSE headers) or assume that using a VPC Gateway Endpoint automatically secures the connection, when in fact the bucket policy's `aws:SecureTransport` condition independently enforces HTTPS.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The application is using HTTP instead of HTTPS

The bucket policy likely includes a condition that denies requests not using HTTPS (i.e., `aws:SecureTransport`: false). The application is failing because it is using HTTP instead of HTTPS to access the S3 bucket, which violates the encryption-in-transit requirement enforced by the policy. Without HTTPS, the request is denied by the S3 service.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The application is not using the VPC endpoint
Why it's wrong here
The Allow statement requires the VPC endpoint, but the Deny statement does not depend on it. If the application uses the endpoint, the Allow is satisfied, but the Deny may still block if not HTTPS.
✗
The bucket policy does not allow encryption in transit
Why it's wrong here
The policy does enforce HTTPS via Deny, but that is not the issue; the issue is likely that the application is not using HTTPS.
✓
The application is using HTTP instead of HTTPS
Why this is correct
The Deny statement blocks requests without SecureTransport, i.e., HTTP. The application may be using HTTP.
✗
The application is missing the required x-amz-server-side-encryption header
Why it's wrong here
No such requirement in the policy.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

3 more ways this is tested on SAP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

hard

A.No, because the IP address is not in the allowed range.
B.Yes, because the IP address is allowed.
✓ C.No, because the request is not using HTTPS.
D.Yes, because the Allow statement is evaluated first.

Why C: The Deny statement with aws:SecureTransport=false explicitly denies requests that are not using HTTPS. Even though the Allow statement permits the IP range, the Deny overrides it. Therefore, the request is denied.

Variation 2. A company has attached the above IAM policy to an IAM role used by an EC2 instance. The EC2 instance is in a VPC with CIDR 10.0.0.0/16 and has a public IP. Which of the following statements is true regarding access to the S3 bucket?

medium

A.The EC2 instance can perform GetObject and PutObject operations if it uses HTTPS
B.The EC2 instance cannot perform any S3 operations because the Deny statement blocks all requests
C.The EC2 instance can perform GetObject and PutObject operations from within the VPC
✓ D.The EC2 instance can perform GetObject and PutObject operations only if it uses a VPC endpoint

Why D: While the Allow statement grants the necessary S3 actions, the Deny statement includes a condition that blocks all requests that do not originate from a VPC endpoint. Since the EC2 instance has a public IP and traffic does not automatically use a VPC endpoint, only requests made through a VPC endpoint will be allowed. Therefore, the correct statement is D.

Variation 3. An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

hard

✓ A.The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.
B.The 'aws:SecureTransport' condition key is misspelled; it should be 'aws:SecureTransport' with a capital T.
C.The bucket policy is missing an 'Allow' statement for HTTPS requests.
D.The resource ARN should be 'arn:aws:s3:::my-unique-bucket-123' without the '/*' to cover PutObject actions.

Why A: The condition key 'aws:SecureTransport' may not be present in all requests (e.g., anonymous requests or certain SDK versions). Using 'Bool' will cause the policy to evaluate to false when the key is missing, allowing unencrypted uploads. 'BoolIfExists' returns true if the key does not exist, effectively blocking requests without the key, which enforces encryption in transit more robustly.

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.