SOA-C02 Security and Compliance Practice Question
A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network
To restrict access to an S3 bucket based on IP range, two elements are required: an S3 bucket policy with a condition using aws:SourceIp to allow s3:GetObject only from the corporate IP range (203.0.113.0/24), and the S3 endpoint (s3.amazonaws.com) must be reachable from the corporate network (typically over the internet). Option A is incorrect because an IAM policy by itself does not restrict bucket-level access; a bucket policy is needed. Option B is not required as CloudFront is not necessary for IP-based restrictions. Option E is incorrect because a VPC endpoint is used for private connectivity within a VPC, not for restricting access from an external IP range.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An IAM policy that allows s3:GetObject from the corporate IP
Why it's wrong here
An IAM policy with an aws:SourceIp condition applies only to the specific IAM principal it is attached to, so it cannot enforce a bucket-wide restriction for all users, including anonymous principals or other IAM identities. Since the requirement is to restrict access to the S3 bucket itself, the correct resource-based mechanism is a bucket policy with an aws:SourceIp condition. This option is insufficient because it does not cover every possible requester.
- ✗
Amazon CloudFront distribution with an origin access identity
Why it's wrong here
A CloudFront distribution with an origin access identity (OAI) is designed to prevent direct access to the S3 origin and force traffic through CloudFront, not to restrict access based on the corporate IP address. CloudFront's edge endpoints are publicly accessible, and enforcing an IP allow-list would require additional mechanisms such as CloudFront IP restrictions or signed URLs, adding complexity without directly fulfilling the requirement. Since the goal is simple IP-based access control to the bucket, CloudFront is unnecessary and does not provide the required restriction by itself.
- ✓
The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network
Why this is correct
For a bucket policy with an aws:SourceIp condition to take effect, the S3 REST endpoint (s3.amazonaws.com) must be reachable from the corporate network. If outbound firewall rules, proxy settings, or DNS resolution prevent access to this endpoint, the request will never reach S3, and the policy condition will never be evaluated. Ensuring endpoint connectivity is therefore a necessary prerequisite for the IP-based access restriction to work as intended.
- ✓
An S3 bucket policy with a condition that uses aws:SourceIp
Why this is correct
An S3 bucket policy with a Condition block that uses aws:SourceIp is the correct resource-based policy to restrict access to a specific corporate IP address or CIDR range. Bucket policies are evaluated for every request made to the bucket, regardless of which IAM identity or anonymous principal sends it, making the restriction comprehensive. The recommended pattern is to explicitly allow s3:GetObject only when the source IP matches the corporate range and otherwise default to deny.
- ✗
A VPC gateway endpoint for S3
Why it's wrong here
A VPC gateway endpoint for S3 provides private connectivity between a VPC and S3 over the AWS internal network, which is unrelated to on-premises corporate users accessing the internet. Moreover, requests coming through a VPC endpoint present a source IP of a private ENI inside the VPC, so an aws:SourceIp condition in a bucket policy would not match the corporate public IP. This option is therefore not required for, and cannot support, internet-based IP-restricted access from a corporate network.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.