SCS-C03 Infrastructure Security Practice Question
Exhibit
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::company-data/*","Condition":{"IpAddress":{"aws:SourceIp":"192.168.1.0/24"}}}]}Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Action' element is missing from the policy, causing it to be invalid.
The policy exhibit is incomplete because it lacks the 'Action' field, which is mandatory in AWS IAM and bucket policies. Without defining the action, the policy is syntactically invalid and will result in an 'Access Denied' error. Ensuring policy syntax is correct is a fundamental step in infrastructure security to prevent accidental service outages caused by misconfigured permissions or invalid JSON structures in resource-based policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC endpoint for S3 is not configured to allow the corporate IP range.
Why it's wrong here
VPC endpoints are for traffic within AWS infrastructure. If users are accessing the bucket from a corporate office (on-premises), traffic flows over the public internet or Direct Connect. The policy condition 'aws:SourceIp' is the correct mechanism for this scenario, but the syntax error in the policy prevents it from functioning.
- ✓
The 'Action' element is missing from the policy, causing it to be invalid.
Why this is correct
The provided JSON is missing the 'Action' key, which is a required component of any IAM policy statement. Without specifying which S3 operations (e.g., s3:GetObject) are allowed, the policy parser will reject the statement, and no access will be granted to any principal attempting to interact with the S3 bucket.
- ✗
The 'aws:SourceIp' condition key is not supported for Amazon S3 bucket policies.
Why it's wrong here
The 'aws:SourceIp' condition key is fully supported in S3 bucket policies for restricting access based on the source IP of the requester. The issue is not the condition key itself, but the overall structure of the JSON policy, which fails to define the permitted actions for the specified principals.
- ✗
The S3 bucket does not have the 'Block Public Access' feature disabled.
Why it's wrong here
While Block Public Access settings can override policies, the primary issue here is the invalid JSON structure. Even if Block Public Access were disabled, the missing 'Action' field ensures the policy cannot be parsed by the IAM engine, making it impossible for the policy to grant any effective permissions to users.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.