SCS-C02 Security Logging and Monitoring Practice Question
A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security team notices that an object was accessed from an IP address outside the allowed VPC. CloudTrail logs show that the access was made using temporary credentials from an assumed role. The role was assumed by an EC2 instance in the allowed VPC. What is the MOST likely reason the access was allowed despite the bucket policy restriction?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy allows access from the VPC endpoint, and the request was made through that endpoint.
The bucket policy uses the aws:SourceVpce condition to restrict access to a specific VPC endpoint. When the EC2 instance in the allowed VPC makes a request, it goes through the VPC endpoint, satisfying the condition. Even though the source IP address appears to be outside the VPC (the VPC endpoint's public IP), the policy evaluates based on the VPC endpoint, not the source IP. Therefore, the request was allowed. Option A is incorrect because encryption in transit is not related to the access restriction. Option C is incorrect because there is no evidence of a syntax error. Option D is incorrect because IAM permissions cannot override a bucket policy that explicitly denies access; the bucket policy allowed the access because the condition was met.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket policy does not require encryption in transit.
Why it's wrong here
Encryption in transit is enforced via a bucket policy condition such as aws:SecureTransport=true, but the issue in this scenario is about the origin of the request, not its transport protocol. The absence of an encryption requirement does not change whether access is allowed; S3 policies without that condition still permit both HTTP and HTTPS requests. Thus, this option does not explain the observed behavior and is incorrect.
- ✓
The bucket policy allows access from the VPC endpoint, and the request was made through that endpoint.
Why this is correct
When a request is sent to S3 through a VPC gateway endpoint, the bucket policy can explicitly allow it using the aws:sourceVpce condition key, which matches the endpoint ID rather than the client's IP address. Because the policy authorizes that specific endpoint, every request routed through it satisfies the policy, regardless of the source IP. This means an IP-based restriction intended for other sources is effectively bypassed, so this option correctly identifies the root cause.
- ✗
The bucket policy has a syntax error that makes it ineffective.
Why it's wrong here
A bucket policy with a syntax error cannot be successfully saved or attached; S3 would reject it, so an invalid policy would not be in effect to produce any unexpected behavior. Since the policy is actively enforcing the described allowance, it must be syntactically valid. Therefore, attributing the outcome to a syntax error is incorrect.
- ✗
The IAM role used by the EC2 instance has permissions that override the bucket policy.
Why it's wrong here
IAM policies and bucket policies are evaluated as separate authorization layers, and an explicit deny in any policy takes precedence over all allows. An IAM role's permissions can grant a principal the ability to perform an action, but they cannot override or bypass a deny enforced by the bucket policy. Moreover, this scenario involves a condition that allows access through the endpoint, so there is no deny for the IAM policy to overcome.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.