ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

Refer to the exhibit. A company has attached the IAM policy to an S3 bucket named example-bucket. Users report they cannot access objects in the bucket even when coming from the allowed IP range. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

S3 Block Public Access settings are enabled, overriding the policy

The policy allows anonymous access (Principal: "*") from a specific IP range. However, S3 Block Public Access settings can override bucket policies by blocking any public access. If S3 Block Public Access is enabled at the account or bucket level, it will deny all public access regardless of the bucket policy. Thus, even though the policy is valid, the Block Public Access setting prevents access. Option D is correct because S3 Block Public Access settings override the policy. Option A is incorrect because the Principal element of "*" is valid for a bucket policy. Option B is incorrect because the condition correctly restricts to the specified IP range; the issue is broader than IP mismatch. Option C is incorrect because aws:SourceIp is used correctly in the condition.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy syntax is invalid because of the Principal element
Why it's wrong here
Principal: "*" is valid for public access.
✗
The IP address range in the condition does not match the users' IP
Why it's wrong here
The policy explicitly allows the range.
✗
The condition uses aws:SourceIp incorrectly
Why it's wrong here
It is used correctly.
✓
S3 Block Public Access settings are enabled, overriding the policy
Why this is correct
Block Public Access denies all public access even if the bucket policy allows it.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question