A Company Wants to Store Sensitive Data in Amazon S3

Multiple Choice

A company wants to store sensitive data in Amazon S3. The S3 bucket and its contents must be accessible only from the on-premises corporate network. What should a SysOps administrator do to configure the S3 bucket policy statement?

A) Use a Deny effect with a condition based on the aws:sourceVpc key.
B) Use a Deny effect with a condition based on the NotIpAddress key.
C) Use an Allow effect with a condition based on the IpAddress key.
D) Use an Allow effect with a condition based on the s3:LocationConstraint key.