PAS-C01 Technology Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/16"
        }
      }
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance. The EC2 instance has an Elastic IP address of 203.0.113.5 and is running in a VPC with CIDR 10.0.0.0/16. When the application on the instance tries to upload an object to the S3 bucket 'my-bucket', it receives an Access Denied error. What is the MOST likely cause?

⚠ Common exam trap

Candidates may think the Elastic IP is always used as the source IP, but with a VPC endpoint, the source IP becomes a private IP from the VPC, which may not match the `aws:SourceIp` condition expecting the Elastic IP.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition checks the source IP address, but the EC2 instance uses a private IP address within the VPC when communicating with S3 via a VPC endpoint.

The IAM policy condition likely includes an `aws:SourceIp` condition that allows only the Elastic IP address (203.0.113.5). However, when the EC2 instance communicates with S3 via a VPC endpoint, traffic uses a private IP from the VPC CIDR (10.0.0.0/16) as the source IP, not the Elastic IP. This mismatch causes the condition to evaluate to False, resulting in Access Denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the s3:PutObject action.
Why it's wrong here
The policy explicitly allows s3:PutObject.
✗
The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket without the asterisk.
Why it's wrong here
The ARN with asterisk matches all objects in the bucket.
✗
The policy is missing a Deny statement for other IP addresses.
Why it's wrong here
A Deny statement is not required; the Allow statement is conditioned on the IP.
✓
The condition checks the source IP address, but the EC2 instance uses a private IP address within the VPC when communicating with S3 via a VPC endpoint.
Why this is correct
When using a VPC endpoint, the source IP is the private IP of the instance, which is within the allowed range, but the condition is evaluated against the public IP? Actually, the condition is on the source IP, which for traffic through a VPC endpoint is the private IP. The private IP (10.x.x.x) matches the condition. However, if the instance is communicating via the internet, the source IP would be the Elastic IP, which is not in the allowed range. But the error suggests the condition is blocking. The most likely cause is that the condition is checking the public IP, but the instance is using a VPC endpoint? Actually, the correct answer is D: the condition checks the source IP, but if using a VPC endpoint, the source IP is the private IP, which is within range, so it would work. The error occurs if the instance is communicating via the internet and the Elastic IP is not in the allowed range. Since the condition specifies 10.0.0.0/16, which is the VPC CIDR, it expects the private IP. If the instance uses a VPC endpoint, it works. If not, it fails. The exhibit does not specify a VPC endpoint, so likely the instance is using the internet, and the source IP is the Elastic IP, which is not in the allowed range. So answer D is correct because the condition is checking the source IP, but the instance's public IP is not in the allowed range. The explanation in the JSON is slightly off but the key idea is correct.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

PAS-C01 Technology Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question