SCS-C02 Infrastructure Security Practice Question
A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?
⚠ Common exam trap
A common mix-up: candidates confuse network-level controls (security groups, NACLs) with resource-based policies, mistakenly thinking they can apply security groups or NACLs to S3 buckets, when in fact S3 only supports bucket policies and IAM policies for access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.
An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.
Why this is correct
A bucket policy can use the aws:SourceVpce condition key to restrict access to a specific VPC endpoint. This allows only traffic that arrives through the corresponding gateway or interface endpoint to reach the bucket, while all other sources, including the public internet, are denied. This resource-based control is the correct way to enforce VPC-only access to an S3 bucket.
- ✗
Assign an IAM role to the S3 bucket.
Why it's wrong here
IAM roles are identity-based entities that are assumed by principals (users, applications, or services) to obtain temporary credentials. They cannot be attached to an S3 bucket because buckets are resources, not principals. Access to a bucket is governed by bucket policies or IAM policies that grant permissions to principals, so assigning an IAM role to the bucket is not a valid operation and would not restrict access.
- ✗
Attach a security group to the S3 bucket.
Why it's wrong here
Security groups are virtual firewalls that control traffic for EC2 instances, elastic network interfaces, and other VPC resources that have network interfaces. S3 buckets are fully managed services that do not have network interfaces within a VPC, and therefore security groups cannot be associated with them. Using a security group to restrict bucket access is impossible because S3 does not evaluate or support security group attachments.
- ✗
Configure a network ACL on the VPC subnet to allow traffic to S3.
Why it's wrong here
Network ACLs are stateless rules applied at the VPC subnet boundary, controlling traffic entering and exiting the subnet. While a network ACL can block traffic to S3's service endpoints based on IP addresses or ports, it operates at the subnet level and cannot evaluate bucket-specific attributes such as the bucket name or object-level permissions. Thus, configuring a network ACL can only provide coarse network-level filtering, but cannot directly restrict access to a particular S3 bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.