SOA-C02 Reliability and Business Continuity Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an S3 VPC endpoint and attach a bucket policy that restricts access to that endpoint.

  Why this is correct

  Creating an S3 VPC gateway endpoint gives your VPC private, routable connectivity to S3 without traversing the public internet. To actually enforce that restriction, the bucket policy must include a condition such as "aws:SourceVpce" or "aws:SourceVpc" so that only requests originating from that endpoint or VPC are allowed; otherwise, the endpoint alone does not block other network paths. This is the only option that both enables private access and explicitly limits the source network to your VPC.

• ✗

  Configure a bucket policy that allows access from the public internet.

  Why it's wrong here

  Writing a bucket policy that allows access from the public internet (e.g., a principal of "*" without a network condition) defeats the stated requirement to keep the bucket accessible only from the VPC. Even if requests originate from an EC2 instance inside the VPC, a broadly permissive policy also permits any external host with the bucket's endpoint to reach the objects. To restrict to the VPC, the policy must deny or conditionally allow requests based on source VPC or VPC endpoint, not merely allow all traffic.

• ✗

  Make the bucket public and rely on IAM roles.

  Why it's wrong here

  Making the bucket public means any anonymous user on the internet can attempt to access the objects, regardless of whether IAM roles are also used. While IAM roles can provide credentials for authenticated access, a public bucket policy or public ACL allows requests without credentials, so it does not confine access to your VPC. To achieve VPC-only access, you need a bucket policy that explicitly denies requests that do not originate from the designated VPC endpoint or VPC, not just reliance on IAM identity-based controls.

• ✗

  Attach a security group to the S3 bucket.

  Why it's wrong here

  Security groups are stateful virtual firewalls that are attached to ENIs, EC2 instances, or other supported AWS resources like RDS and Lambda; they are not a valid attachment for S3 buckets. S3 does not have the concept of a security group at the bucket level, and its network access controls are implemented via bucket policies, ACLs, IAM policies, and VPC endpoint conditions. Attempting to attach a security group to an S3 bucket is not supported, so this option cannot provide any network restriction.

Go deeper

Related to this question