SCS-C03 Incident Response Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-secure-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "192.0.2.0/24"
}
}
}
]
}Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.
The bucket policy is a resource-based policy that only grants permissions; it does not explicitly deny access from other IP addresses. In AWS, if an IAM user or role has an identity-based policy allowing 's3:GetObject' on that bucket, the resource-based policy will not restrict them unless it contains an explicit Deny. This behavior highlights the importance of using explicit Deny statements when enforcing network-based access controls on sensitive resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.
Why this is correct
Because the policy is an Allow statement, it acts as an additional permission grant rather than a restriction. IAM entities with sufficient permissions elsewhere in the account are not restricted by this policy because it does not contain a Deny rule to supersede those identity-based permissions.
- ✗
The bucket policy must include a Principal element to restrict access to specific identities.
Why it's wrong here
While a Principal element is standard for bucket policies, the issue here relates to the evaluation logic of Allow vs. Deny. Even if a Principal was specified, the lack of an explicit Deny means that other authorized IAM users could still access the bucket outside the provided IP range.
- ✗
The S3 bucket is configured with a public access block that is too permissive.
Why it's wrong here
Public Access Block settings are designed to prevent public access, but they do not override the logic of bucket policies regarding authenticated access. The bypass is caused by the interaction between the resource policy and the identity-based policy, not by the public access block configuration of the bucket.
- ✗
The 'aws:SourceIp' condition does not function for requests made through an AWS service like CloudFront.
Why it's wrong here
While it is true that SourceIp can behave differently with proxies or CloudFront, the fundamental issue is the policy's structure. Regardless of the IP source, the absence of a Deny statement means that any user with existing IAM permissions remains authorized to access the bucket's content.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.