SCS-C03 Security Foundations and Governance Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "192.168.1.0/24"
}
}
}
]
}Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An explicit Deny statement exists elsewhere.
IAM policy logic follows the principle of implicit deny. If there is an explicit 'Deny' statement anywhere in the policy evaluation (including the bucket policy or an SCP) that contradicts this 'Allow', access will be denied. Additionally, if the user does not have the 's3:ListBucket' permission, they might be unable to navigate the bucket, even if they can retrieve a specific object when provided with the direct key path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CIDR range is too small for VPC traffic.
Why it's wrong here
The CIDR range is a valid network notation and has no impact on the technical validity of the IAM policy. The issue is not the size of the range, but rather the overall evaluation logic of IAM policies, which involves multiple layers of potential denials across the environment.
- ✓
An explicit Deny statement exists elsewhere.
Why this is correct
In AWS, an explicit 'Deny' always overrides an 'Allow'. Even if this user policy permits access, if a bucket policy or an SCP denies access for that user, the request will be rejected. This hierarchical evaluation is a fundamental part of AWS security governance and complex permission management.
- ✗
The resource ARN is missing the bucket name.
Why it's wrong here
The resource ARN 'arn:aws:s3:::my-bucket/*' is correctly formatted and includes the bucket name. The issue is not the resource pathing, but rather the global permission evaluation logic that applies across different policy types when multiple layers are involved in controlling access to sensitive data.
- ✗
S3 does not support the 'aws:SourceIp' condition.
Why it's wrong here
S3 fully supports the 'aws:SourceIp' condition key. The limitation is not with the service, but with the evaluation hierarchy of policies. The user's inability to access the bucket is likely due to other conflicting policies or missing permissions, not a limitation of the condition key itself.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.