SAP-C03 practice question: Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access) (1 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital group keeps patient imaging in Amazon S3 buckets across 20 accounts in its AWS organization. A research partner outside the organization has been granted read access to one shared dataset, and an administrator in one account has just changed a bucket policy that now allows the access to every AWS principal.
The security team needs a control that the account administrators cannot override, which stops any principal outside the organization from reading these buckets, whatever a bucket policy says. The control must not block the organization's own accounts or AWS services that legitimately access the buckets.
Which solution meets these requirements?
Choose one answer.
AA. Attach a service control policy to the organization root that denies s3:GetObject when aws:PrincipalOrgID does not match the organization ID.
BB. Turn on S3 Block Public Access for every bucket in all 20 accounts, so no bucket policy can grant public access.
CC. Add an aws:PrincipalOrgID condition to the bucket policy of every bucket in each account, so that only principals in the organization can read the buckets, and add it to the template for new buckets.
DD. Attach a resource control policy to the organization root that denies s3:GetObject when aws:PrincipalOrgID does not match, with exceptions for the AWS service principals that need access.
Show the answer and explanation
Answer: D
A. Wrong: SCPs limit what principals inside member accounts can do. They do not apply to an external principal's access to a bucket in the organization, so the external reader would not be stopped.
B. Wrong: Block Public Access stops anonymous and public grants, but it does not stop access granted to one named external account. The partner's access would still work.
C. Wrong: This works while each bucket policy stays correct, but an account administrator can change the policy. The control does not hold centrally, which is the requirement the security team set.
D. Right: Correct. Resource control policies apply to resources in member accounts, so the deny holds regardless of the bucket policy. The org ID condition blocks external principals, and the service principal exception keeps legitimate AWS services working.
Explanation
An RCP is the organization-level control that applies to the resources themselves, so it holds regardless of bucket policy edits by account administrators. SCPs do not cover external principals, and Block Public Access and per-bucket conditions leave the named partner access or the central control unmet.
Want more on Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access)? The 5 full-length practice sets have 7 more Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →