ANS-C01 Network Security, Compliance and Governance Practice Question
Exhibit
Refer to the exhibit.
Resource Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::example-bucket/confidential/*",
"Condition": {
"StringEquals": {
"s3:ExistingObjectTag/classification": "public"
}
}
}
]
}A security engineer created the above S3 bucket policy to grant public read access to objects in the 'confidential/' prefix. However, users report that they receive 'Access Denied' errors when trying to access objects that have the tag 'classification: public'. What is the most likely cause?
⚠ Common exam trap
AWS often tests the interaction between prefix-based and tag-based conditions in S3 bucket policies, leading candidates to overlook that both conditions must be satisfied simultaneously, not just one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.
The bucket policy includes a condition that requires the object to have the tag 'classification: public' (using s3:ExistingObjectTag). If the objects in the 'confidential/' prefix do not have this tag, the condition fails and access is denied, even though the prefix matches. The policy explicitly grants public read access only to objects that satisfy both the prefix and the tag condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket policy does not grant access to objects owned by other AWS accounts.
Why it's wrong here
The policy allows all principals, but the condition fails.
- ✗
The 's3:GetObjectVersion' action is not allowed because the bucket is not versioned.
Why it's wrong here
The action is included but irrelevant; the condition is the issue.
- ✓
The objects in the 'confidential/' prefix do not have the required tag 'classification: public'.
Why this is correct
The condition requires the tag; without it, access is denied.
- ✗
The condition should use 'StringLike' instead of 'StringEquals' for tag matching.
Why it's wrong here
StringEquals is appropriate for exact match; StringLike would not change the outcome if tag is missing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.