SCS-C02 Management and Security Governance Practice Question
A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security engineer tests the configuration and finds that requests from the VPC endpoint are being denied. The bucket policy contains the following condition: "Condition": { "StringEquals": { "aws:SourceVpce": "vpce-12345678" } }. The VPC endpoint ID is correct. The engineer also confirms that the VPC endpoint policy allows the necessary S3 actions. What is the most likely reason for the denial?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request is not being routed through the VPC endpoint; the EC2 instance is using a public S3 endpoint.
The bucket policy condition aws:SourceVpce only appears in requests that are routed through the specified VPC endpoint. If the EC2 instance accesses S3 via the public internet (using the public S3 endpoint), the request does not include the condition key, and the condition fails, causing denial. Option A correctly identifies this misrouting. Options B, C, and D are not the primary cause: IAM roles are not the issue here because the bucket policy is denying based on the condition; cross-region access is allowed via endpoints; and the condition key is correctly spelled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The request is not being routed through the VPC endpoint; the EC2 instance is using a public S3 endpoint.
Why this is correct
If not using endpoint, the condition key is not present.
- ✗
The EC2 instance does not have an IAM role that allows s3:GetObject.
Why it's wrong here
The bucket policy should grant access regardless of IAM role.
- ✗
The VPC endpoint is in a different region than the S3 bucket.
Why it's wrong here
S3 supports cross-region VPC endpoints.
- ✗
The condition key is misspelled; it should be aws:SourceVpce (no 'e' at the end).
Why it's wrong here
Condition key is correct.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.