SCS-C02 VPC Endpoint for Amazon S3/Athena Practice Question
A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)
⚠ Common exam trap
A common trap is confusing VPC endpoint policies with source IP conditions. When using a VPC endpoint, you must use aws:SourceVpce in the bucket policy, not s3:SourceIp.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.
A: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. C: Correct – Creating a VPC endpoint for Athena (or S3) and attaching a bucket policy that restricts access to that endpoint ensures queries are only allowed from the specified VPC subnets. B: Incorrect – The s3:SourceIp condition key does not work for requests made via VPC endpoints; use aws:SourceVpce instead. D: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – SSE-S3 does not use KMS, so the KMS key policy would not be relevant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.
Why this is correct
Correct – Provides kms:Decrypt permission and ensures the KMS key policy allows the IAM role, enabling Athena to decrypt objects encrypted with a customer-managed KMS key.
- ✗
Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.
Why it's wrong here
Incorrect – s3:SourceIp does not work for VPC endpoint requests; use aws:SourceVpce instead.
- ✓
Create a VPC endpoint for Athena and attach a bucket policy that restricts access to that endpoint.
Why this is correct
Correct – A VPC endpoint for Athena (or S3) with a bucket policy restricting access to that endpoint ensures queries only come from the specified VPC subnets.
- ✗
Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.
Why it's wrong here
Incorrect – kms:EncryptionContext is used for encryption context, not for restricting encryption at rest.
- ✗
Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.
Why it's wrong here
Incorrect – SSE-S3 does not use KMS, so the KMS key policy is irrelevant.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.