SAP-C02 Question 114

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  I will go with B as Endpoint Policies are optional and by default allow full access whereas IAM Policies are a lot more fine-grained, so to distinguish between IAM Policy and Endpoint Policy. Think simply, who can do what on which AWS Resource - IAM Policy. What is allowed through this specific VPC Endpoint - Interface VPC Endpoint

• Chose D1

  The VPC endpoint policy is what actually controls traffic through the endpoint, not IAM permissions to "use" the endpoint.

• Chose D1

  While you need IAM permission to use a service, you don't need IAM permissions to use an interface VPC endpoint itself. Hence, B is incorrect. Note that D is merely suggesting "Ensure that the VPC endpoint policy allows traffic from the applications.". It isn't saying VPC endpoint policy must be created. In brief, D is the correct answer.