DVA-C02 Security Practice Question

Exhibit

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "192.0.2.0/24"
                }
            }
        }
    ]
}

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket. Users from the 192.0.2.0/24 network can access objects, but users from a different network (203.0.113.0/24) get access denied. What change should be made to allow both networks?

⚠ Common exam trap

The trap here is that candidates mistakenly think the `aws:SourceIp` condition key can only hold a single value, leading them to choose Option B, when in fact it accepts a list of IP ranges to allow multiple networks.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the Condition to use a list of IP ranges: ["192.0.2.0/24", "203.0.113.0/24"].

The `aws:SourceIp` condition key accepts a list of IP ranges in an array format. By specifying both `192.0.2.0/24` and `203.0.113.0/24` in the condition, the bucket policy will grant access to requests originating from either network, resolving the access denied error for the second network.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add a new statement with a different Principal.
Why it's wrong here
Adding a new statement with a different Principal would not resolve the issue of allowing multiple specific IP ranges for the *existing* access pattern. The current statement likely uses Principal: "*", indicating broad access for authenticated users, which is not the part of the policy that needs modification. The problem lies in the Condition block's handling of aws:SourceIp, and introducing another principal would only create a separate access rule, not fix the IP restriction for the intended users.
✗
Change the Condition to aws:SourceIp: "203.0.113.0/24".
Why it's wrong here
Modifying the Condition to exclusively specify aws:SourceIp: "203.0.113.0/24" would restrict access solely to that particular network. This change would inadvertently deny access from the 192.0.2.0/24 network, which is also required. The objective is to permit access from *both* specified IP ranges, and this option only allows one, thus failing to meet the complete requirement.
✗
Remove the Condition block entirely.
Why it's wrong here
Removing the entire Condition block would eliminate the IP address restriction, allowing access to the S3 bucket from any IP address globally. While this would technically permit access from both 192.0.2.0/24 and 203.0.113.0/24, it introduces a significant security vulnerability by removing a critical layer of network perimeter control. This approach is generally not recommended as it broadens access far beyond the intended scope.
✓
Change the Condition to use a list of IP ranges: ["192.0.2.0/24", "203.0.113.0/24"].
Why this is correct
AWS IAM policies support specifying multiple values for a single condition key by using a JSON array. When aws:SourceIp is assigned a list like ["192.0.2.0/24", "203.0.113.0/24"], the condition evaluates to true if the request originates from *any* of the IP ranges within that list. This correctly allows access from both the 192.0.2.0/24 and 203.0.113.0/24 networks, fulfilling the requirement in a single, concise policy statement.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DVA-C02 Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question