SAP-C03 practice question: Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access) (2 of 2)

Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A hospital group's analytics team reads imaging data from an S3 bucket in its organization. The security team requires that the data may be read only through the group's own VPC endpoint for S3, and only by principals in the group's organization.

The endpoint and the bucket are both controlled by the central security team, and the team must allow the analytics jobs, which run in the group's VPCs, to keep working without adding a public route. Requests from the internet, or from another VPC's endpoint, must fail.

Which TWO controls meet these requirements? (Choose two.)

Choose two answers.

A. Give the VPC endpoint a policy that allows s3:* for every principal, and leave the bucket policy unchanged, so the endpoint carries the traffic privately.
B. Add a bucket policy statement that denies all s3 actions when aws:SourceVpce is not one of the group's endpoint IDs, so requests must come through the group's own endpoint.
C. Turn on S3 Block Public Access on the bucket and enable server-side encryption with a customer managed key, so only the encrypted private path can read the objects.
D. Create a service control policy that denies all S3 calls unless they come through a VPC endpoint, and attach it to the organization root.
E. Give the VPC endpoint a policy that allows only principals whose aws:PrincipalOrgID matches the organization ID and that access only the group's bucket.

Show the answer and explanation

Answers: B, E

A. Wrong: An endpoint policy that allows every principal does not check who is calling, and without a bucket condition, requests from outside the endpoint are not blocked. This does not meet the organization requirement.
B. Right: Correct. The deny is enforced on the bucket side and blocks requests from any other endpoint or from the internet. Analytics jobs still succeed through the group's endpoint.
C. Wrong: Block Public Access and encryption do not check which endpoint or principal makes the call. A reader with the right IAM permissions could still read the objects from anywhere.
D. Wrong: An SCP restricts only principals in the organization's member accounts, so it does not stop a principal outside the organization from reading the bucket. The perimeter has to be enforced in the bucket and endpoint policies.
E. Right: Correct. The endpoint policy limits which organization principals can reach S3 through this endpoint, so the organization check and the bucket restriction apply on the private path. Analytics jobs in the group's VPCs keep working.

Explanation

A bucket policy that requires the group's endpoint IDs and an endpoint policy that requires organization principals together form the network and identity perimeter. An open endpoint policy, an SCP alone, and encryption or Block Public Access each leave requests from outside the perimeter allowed.

SAP-C03 practice question: Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access) (2 of 2)

Explanation

Study

Keep practicing