mediumMultiple ChoiceObjective-mapped

CAS-004 Network-based policy condition Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-123abc"
        }
      }
    }
  ]
}
```

Refer to the exhibit. Which of the following best describes the security constraint imposed by this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Only allows access from a specific network endpoint.

The condition in the policy requires the request to originate from a specified network endpoint, enforcing a network-level constraint.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Only allows access during business hours.
Why it's wrong here
This option describes a time-based constraint, not a network-based one.
✗
Only allows access from a specific user account.
Why it's wrong here
This option describes an identity-based constraint, not a network-based one.
✗
Only allows access to a specific storage bucket.
Why it's wrong here
This option describes a resource-based constraint, not a network-based one.
✓
Only allows access from a specific network endpoint.
Why this is correct
Correct. The policy condition requires the request to originate from a specific network endpoint, enforcing network-level access control.

Go deeper

CAS-004 Network-based policy condition Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question