SOA-C02 Security and Compliance Practice Question
A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.
Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and route table updates are required. Option C is wrong because IAM users alone do not restrict access by VPC; a bucket policy with a VPC condition is needed. Option E is wrong because security groups cannot be attached to S3 buckets as they are not network interfaces.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.
Why this is correct
This bucket policy explicitly denies all S3 access unless the vpc:SourceVpce condition matches the specified VPC endpoint (e.g., vpce-12345678). You must include both an Allow statement for the principal (such as the account root) and a Deny statement with StringNotEquals to prevent all other network paths. Requests from the VPC endpoint will carry the vpcSourceVpce value automatically, so only traffic routed through that endpoint is permitted.
- ✓
Update the route table in the VPC to route S3 traffic through the VPC endpoint.
Why this is correct
For a gateway VPC endpoint for S3, you must add a route to the VPC route table with the S3 prefix list (e.g., com.amazonaws.us-east-1.s3) as the destination and the VPC endpoint as the target. This directs all VPC traffic destined to S3 IP ranges through the endpoint instead of the internet gateway. Without this route, traffic would reach S3 over the public internet, which would fail the vpc:SourceVpce condition and thus be denied by the bucket policy.
- ✗
Create IAM users and assign them permissions to access the bucket.
Why it's wrong here
Creating IAM users and granting them S3 permissions controls which identities can access the bucket, but it does not restrict the network location from which those identities make requests. A user with valid IAM credentials could still call s3:GetObject from any IP address or VPC, bypassing the intended VPC restriction entirely. To enforce the required network-level isolation, you need a bucket policy with a vpc:SourceVpce condition, which is independent of any IAM user setup.
- ✓
Create a VPC endpoint for S3 in the specified VPC.
Why this is correct
A VPC endpoint for S3 is required to provide private connectivity from the VPC to S3; for S3, this is typically a gateway endpoint, which appears as a target in route tables and does not require an internet gateway, NAT device, or VPN connection. You must create the endpoint in the specified VPC before the bucket policy's vpc:SourceVpce condition can work, because the condition value only exists in requests that travel through that endpoint. Without the endpoint, there is no VPC endpoint ID to match.
- ✗
Attach a security group to the S3 bucket.
Why it's wrong here
Security groups are virtual firewalls that operate at the elastic network interface (ENI) level for EC2 instances and other resources like RDS or Lambda, not for S3 buckets, which are regional services without a VPC CIDR to apply a security group to. Even when using a VPC interface endpoint for S3, the security group attaches to the endpoint's ENI, not to the bucket itself. Therefore, attaching a security group to the S3 bucket is impossible and irrelevant; bucket policies or IAM policies are the correct enforcement mechanisms.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an EC2 instance that needs to access an S3 bucket. The instance is launched in a private subnet with no internet gateway. What is the most secure way to provide access to S3 without traversing the internet?
hard- A.Use a NAT gateway in a public subnet
- ✓ B.Create an S3 VPC gateway endpoint
- C.Set up an AWS Direct Connect connection
- D.Attach an internet gateway to the VPC and a public IP to the instance
Why B: An S3 VPC gateway endpoint allows EC2 instances in a private subnet to access S3 privately using AWS’s internal network, without requiring an internet gateway, NAT gateway, or public IP. Traffic stays within the AWS backbone, never traversing the internet, which provides the most secure and cost-effective solution for this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.