SCS-C03 Infrastructure Security Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::sensitive-data/*"],
"Condition": {"StringNotEquals": {"aws:SourceVpce": "vpce-1a2b3c4d"}}
}]
}Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It prevents any access to the bucket from outside the specified VPC endpoint.
This bucket policy uses an explicit 'Deny' with a 'StringNotEquals' condition. This pattern is a powerful security control that implements a 'perimeter' around the bucket. It ensures that any request not originating from the specified VPC Endpoint (vpce-1a2b3c4d) is rejected, regardless of any other 'Allow' permissions the user might have.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It allows all users in the VPC to access the bucket if they use the specified VPC endpoint.
Why it's wrong here
An explicit 'Deny' statement does not grant access; it only restricts it. Users still need an explicit 'Allow' statement (either in an IAM policy or elsewhere in the bucket policy) to gain access. This policy simply ensures that even authorized users must use the specific VPC endpoint to connect.
- ✓
It prevents any access to the bucket from outside the specified VPC endpoint.
Why this is correct
Because 'Deny' overrides 'Allow' in AWS evaluation logic, this policy effectively blocks all traffic—including from the AWS Management Console or other VPCs—unless it originates from vpce-1a2b3c4d. This is a common pattern for securing highly sensitive data against accidental exposure or credential theft.
- ✗
It only denies access to the bucket if the user is using a different VPC endpoint, but allows public access.
Why it's wrong here
Public access would not originate from the specified VPC endpoint, so it would trigger the 'StringNotEquals' condition and be denied. The policy covers all principals ('*'), meaning it applies to everyone, including anonymous users, effectively preventing any public access to the data stored in the bucket.
- ✗
It restricts access to the bucket to only the root user of the account via the VPC endpoint.
Why it's wrong here
The policy applies to all principals ('*'), not just the root user. While it forces everyone to use the VPC endpoint, it does not distinguish between different IAM users or roles within the account. All identities are subject to the same restriction of having to use the designated endpoint.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.