An EC2 instance in a VPC tries to download an object from a restricted S3 bucket but receives AccessDenied. What are possible causes? (Choose two.)

An EC2 instance accessing S3 relies on its associated IAM role and the S3 bucket policy. An AccessDenied error strongly suggests a permission issue. If the IAM role attached to the EC2 instance does not grant sufficient permissions to perform the s3:GetObject action on the specific S3 bucket and object, access will be denied. Similarly, an explicit Deny statement in the S3 bucket policy that matches the EC2 instance's principal or IP address, or a missing Allow statement, would also result in AccessDenied. Incorrect options: S3 bucket default encryption being enabled does not inherently deny access; the EC2 instance's IAM role just needs permissions for KMS if a custom key is used. An object archived to S3 Glacier would return an InvalidObjectState error, not AccessDenied, as it needs to be restored first. S3 Versioning being enabled does not affect access permissions.