CLF-C02 Security and Compliance Practice Question
A developer needs to read objects from a specific Amazon S3 bucket. Following AWS security best practices, which approach should be used when creating the IAM policy for this developer?
⚠ Common exam trap
Many candidates choose broad managed policies like AmazonS3FullAccess because they seem 'safe' or 'easier to manage,' overlooking that AWS explicitly recommends least-privilege policies and that over-permissioning is a common cause of data breaches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant only s3:GetObject permission on the specific bucket
The principle of least privilege dictates granting only the specific permissions required for the task. By attaching an IAM policy with only the s3:GetObject action on the specific bucket ARN, the developer can read objects without having unnecessary permissions that could lead to accidental or malicious changes. This approach aligns with AWS security best practices for IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant AdministratorAccess to ensure all required permissions are included
Why it's wrong here
AdministratorAccess grants full access to all AWS services and actions, including IAM user and policy management, which an S3 read-only developer has no legitimate reason to use. This policy also allows privilege escalation — for example, the developer could create new IAM users, attach policies to their own role, or disable billing and security controls, effectively giving them root-level power. Under least privilege, permissions should be scoped to the single required API call, not a blanket account-wide admin grant that exposes the entire account if the credentials are stolen.
- ✗
Grant AmazonS3FullAccess to cover all S3 operations
Why it's wrong here
AmazonS3FullAccess is a managed policy that grants every S3 action (s3:*) on all resources, including DeleteBucket, PutBucketPolicy, and ListAllMyBuckets. A developer who only needs to read a single object would be able to delete the entire bucket, modify its permissions, or access any other object in the account's other buckets. This broad scope far exceeds the required s3:GetObject on one bucket ARN, directly violating least privilege by expanding the attack surface and blast radius of any compromised credentials.
- ✓
Grant only s3:GetObject permission on the specific bucket
Why this is correct
Granting only s3:GetObject on the specific S3 bucket ARN (and optionally the object ARN) gives the developer exactly the read capability required — no more, no less. This is the textbook application of the least privilege principle: the IAM policy allows a single action on a single resource, so the developer cannot list, write, delete, or modify any other object or bucket. If the credentials leak, the attacker can only read that one bucket's objects, which is the minimal possible impact that still satisfies the business need.
- ✗
Use the root account credentials since they guarantee access
Why it's wrong here
Root account credentials provide unrestricted access to every AWS service, including IAM, billing, and security settings, and should never be used for day-to-day developer tasks. Beyond violating least privilege, using root bypasses all IAM controls: there is no way to scope, rotate, or audit root access as effectively as IAM roles, and root credentials are extremely high-value targets for attackers. AWS best practice mandates enabling MFA on root and using IAM users/roles with temporary credentials instead — root is reserved for account-level recovery and ownership tasks only.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.