SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "MyBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "my-bucket-12345",
        "VersioningConfiguration": {
          "Status": "Enabled"
        }
      }
    },
    "MyBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {"Ref": "MyBucket"},
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::my-bucket-12345/*",
              "Condition": {
                "IpAddress": {
                  "aws:SourceIp": "203.0.113.0/24"
                }
              }
            }
          ]
        }
      }
    }
  }
}

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

⚠ Common exam trap

A common mix-up: candidates assume a bucket policy with Principal '*' automatically allows all access, ignoring the condition block that can restrict access based on IP address or other attributes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Access is denied because the IP is not allowed.

The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Access is allowed because the Principal is "*".
Why it's wrong here
The Principal is "*", but the Condition restricts by IP.
✗
Access is denied because the bucket is not public.
Why it's wrong here
The bucket policy allows access, but only from specific IPs.
✗
Access is allowed because the policy does not explicitly deny.
Why it's wrong here
Deny is not required; the Allow only applies to the IP range.
✓
Access is denied because the IP is not allowed.
Why this is correct
The policy restricts access to the specified IP range.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Design for New Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question