Step2Study
CompTIA Cloud+ (CV0-004)SecurityMedium

A cloud security architect is reviewing the access policies for a critical storage bucket containing customer PII. The current policy allows access from specific IP addresses. To further enhance security, the architect wants to ensure that access is ONLY granted if the request originates from a specific Virtual Private Cloud (VPC) endpoint, preventing any direct internet access to the bucket, even from allowed IPs. Which type of policy condition would achieve this?

  1. ATime-based condition
  2. BSource IP address condition
  3. CUser-agent condition
  4. DVPC endpoint condition
Show answer & explanation

Correct answer: D. VPC endpoint condition

A VPC endpoint condition within a resource policy ensures that access to the resource (like an S3 bucket) is only allowed if the request is routed through a specified VPC endpoint. This effectively blocks any direct internet access to the bucket, even from otherwise authorized IP addresses, forcing all traffic through the private network path.

Why the other options are wrong

  • A. A time-based condition restricts access to certain hours or days but does not control the network path or prevent direct internet access.
  • B. A source IP address condition allows access from specific public IPs, but does not prevent direct internet access if those IPs are compromised or if traffic can bypass the private network.
  • C. A user-agent condition filters requests based on the client application making the request, not its network origin or path.

VPC Endpoint Condition

A VPC endpoint condition in a cloud resource policy restricts access to resources (e.g., storage buckets, databases) to only requests originating through a specified Virtual Private Cloud (VPC) endpoint.

  • Forces traffic over a private network path, bypassing the public internet.
  • Enhances security for sensitive data by preventing direct internet exposure.
  • Used in conjunction with other access policies (e.g., bucket policies).

Memory trick: VPC endpoints are the ONLY private doors to your data.

Practice this question Study as flashcard All questions
Previous question

More Security questions