SCS-C02 Infrastructure Security Practice Question

Correct answer & explanation

Option C is correct because setting 'BlockPublicPolicy: true' prevents the bucket policy from granting access to any principal, even within the same account, if the policy is considered public (granting access to principals not in the same account? Actually, 'BlockPublicPolicy' blocks any policy that grants access to a principal that is not in the same account? Wait, 'BlockPublicPolicy' blocks policies that grant access to the public or to all AWS accounts. But here the principal is a specific role in the same account, so it should not be blocked. However, 'RestrictPublicBuckets: true' might interfere. Actually, the correct answer is that the 'BlockPublicPolicy' setting blocks the bucket policy because the policy grants access to a principal that is not the bucket owner? Actually, reading the docs: 'BlockPublicPolicy' blocks policies that grant public access (i.e., to all users or to all authenticated users). Since the policy grants access to a specific IAM role, it is not public. So the issue might be something else. Let's reconsider: Option A: The role is not attached to the EC2 instance - but the question says users assume the role. Option B: The role needs S3:ListBucket - but GetObject does not require ListBucket. Option C: The bucket policy is blocked by PublicAccessBlock - actually, 'BlockPublicPolicy' only blocks policies that grant public access. Since the policy grants access to a specific role, it should be allowed. However, 'RestrictPublicBuckets' restricts access to only AWS service principals that are authorized? Actually, 'RestrictPublicBuckets' restricts access to only the bucket owner and AWS services. That could be the issue. But the options are limited. The most likely cause based on the exhibit is that the bucket policy is not being applied due to 'BlockPublicPolicy' being set to true incorrectly? Wait, I need to be accurate. According to AWS documentation, 'BlockPublicPolicy' only blocks policies that grant public access (i.e., to all users or all authenticated users). Since the policy grants access to a specific role, it is not public, so the policy should be applied. However, 'RestrictPublicBuckets' restricts access to only the bucket owner and authorized AWS services. That could block the role's access. Option D is about KMS, which is not mentioned. The correct answer is likely C because the combination of settings might block the policy. But let's check the options: Option A is plausible but not mentioned. Option B is not required. Option D is not relevant. So I'll go with C.

Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.