The answer is that the bucket policy allows public read access in addition to the OAI access. Even when an Origin Access Identity is correctly configured, CloudFront OAI still allows direct S3 access if the bucket policy grants any public read permissions, because the OAI only restricts access through CloudFront—it does not automatically block direct S3 URLs. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding that the bucket policy must explicitly deny all principals except the OAI; a common trap is assuming the OAI alone locks down the bucket. The key memory tip is “OAI is a gatekeeper for CloudFront, not a bouncer for S3”—you must write the bucket policy to deny everyone else.
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is using Amazon CloudFront with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible via CloudFront. The SysOps administrator has configured an Origin Access Identity (OAI) and updated the bucket policy to allow access only to the OAI. However, users are still able to access the S3 bucket directly via the S3 URL. What is the most likely reason?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
The bucket policy does not include a condition to require the OAI.
Why wrong: The OAI works by specifying the OAI as the principal in the bucket policy; a condition is not required.
B
The bucket policy allows public read access in addition to the OAI access.
If the bucket policy grants public read access (e.g., Principal: "*"), users can bypass CloudFront and access the bucket directly. The policy should only allow the OAI and deny all others.
C
The OAI is not properly associated with the CloudFront distribution.
Why wrong: The administrator has configured the OAI, so it is likely associated correctly.
D
The S3 bucket is configured as a static website.
Why wrong: Static website hosting does not bypass OAI; the OAI still applies.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy allows public read access in addition to the OAI access.
The OAI restricts access to the bucket when accessed via CloudFront, but if the bucket policy allows public read access, users can still access the bucket directly. The OAI restriction must be the only means of access; the bucket policy must deny all other principals. Option B is incorrect because the OAI is properly associated. Option C is incorrect because the bucket is not set to static website hosting. Option D is incorrect because the bucket policy does not need to include a condition if it denies everyone except the OAI.
Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The bucket policy does not include a condition to require the OAI.
Why it's wrong here
The OAI works by specifying the OAI as the principal in the bucket policy; a condition is not required.
✓
The bucket policy allows public read access in addition to the OAI access.
Why this is correct
If the bucket policy grants public read access (e.g., Principal: "*"), users can bypass CloudFront and access the bucket directly. The policy should only allow the OAI and deny all others.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Standard ACLs match source addresses.
✗
The OAI is not properly associated with the CloudFront distribution.
Why it's wrong here
The administrator has configured the OAI, so it is likely associated correctly.
✗
The S3 bucket is configured as a static website.
Why it's wrong here
Static website hosting does not bypass OAI; the OAI still applies.
Common exam traps
Common exam trap: ACLs stop at the first match
ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.
Detailed technical explanation
How to think about this question
ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.
KKey Concepts to Remember
Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.
TExam Day Tips
→Check inbound versus outbound direction.
→Read the ACL from top to bottom.
→Look for a broader permit or deny above the intended line.
Key takeaway
ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SOA-C02 ACL questions on filtering logic and placement.
Networking and Content Delivery — This question tests Networking and Content Delivery — Standard ACLs match source addresses..
What is the correct answer to this question?
The correct answer is: The bucket policy allows public read access in addition to the OAI access. — The OAI restricts access to the bucket when accessed via CloudFront, but if the bucket policy allows public read access, users can still access the bucket directly. The OAI restriction must be the only means of access; the bucket policy must deny all other principals. Option B is incorrect because the OAI is properly associated. Option C is incorrect because the bucket is not set to static website hosting. Option D is incorrect because the bucket policy does not need to include a condition if it denies everyone except the OAI.
What should I do if I get this SOA-C02 question wrong?
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SOA-C02 ACL questions on filtering logic and placement.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Standard ACLs match source addresses.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Amazon CloudFront distribution with an S3 bucket as origin. The bucket contains sensitive data. Which configuration ensures that users access the content only through CloudFront and not directly via the S3 URL?
easy
A.Enable S3 server-side encryption
✓ B.Configure an Origin Access Identity (OAI) in CloudFront and update the bucket policy
C.Use CloudFront signed URLs or signed cookies
D.Enable S3 Block Public Access on the bucket
Why B: Option B is correct by using an Origin Access Identity (OAI) to restrict S3 bucket access to only CloudFront. Option A is wrong because blocking public access alone doesn't allow CloudFront access. Option C is wrong because CloudFront signed URLs control access to CloudFront, but the bucket still needs permission. Option D is wrong because server-side encryption doesn't restrict access paths.
Variation 2. A company is using Amazon CloudFront to deliver content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which TWO steps should be taken?
medium
A.Generate presigned URLs for all objects in the S3 bucket.
✓ B.Configure the S3 bucket policy to grant the OAI s3:GetObject permission.
C.Configure CloudFront signed URLs to limit viewer access.
✓ D.Create an Origin Access Identity (OAI) for the CloudFront distribution.
E.Set the S3 bucket policy to allow access only from the CloudFront distribution ID.
Why B: Options A and C are correct. Creating an Origin Access Identity (OAI) and granting it read access to the S3 bucket, then configuring the bucket policy to deny all other principals, ensures only CloudFront can access the content. Option B is incorrect because presigned URLs are for individual user access, not for CloudFront origin access. Option D is incorrect because CloudFront signed URLs restrict viewer access, not origin access. Option E is incorrect because bucket policies use OAI, not CloudFront distribution IDs.
Variation 3. A company uses Amazon CloudFront to serve content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Users report that they can access the content via CloudFront but also directly via the S3 bucket URL. How can the company restrict direct access to the S3 bucket?
hard
A.Disable OAC and use Origin Access Identity (OAI) instead.
B.Use pre-signed URLs for all S3 requests.
C.Remove the bucket policy and rely on ACLs.
✓ D.Update the S3 bucket policy to deny access to any principal other than the CloudFront service.
Why D: Option A is correct because an S3 bucket policy that denies all access except when the request includes a specific CloudFront header (via OAC) or is from the CloudFront service principal is the standard way to restrict direct access. Option B is wrong because removing the bucket policy would make the bucket public if ACLs allow, but OAC requires a bucket policy to allow CloudFront access. Option C is wrong because using a pre-signed URL is for temporary access, not for blocking direct access. Option D is wrong because OAC already restricts access to CloudFront only; the bucket policy must explicitly deny all other principals.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.