SCS-C02 Infrastructure Security Practice Question

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

⚠ Common exam trap

Many candidates think modifying the bucket policy to deny all principals (Option C) is acceptable, but the question explicitly forbids deleting the policy, and modifying it to deny all principals is a form of policy deletion; the correct approach uses a conditional deny with an impossible condition to avoid altering the original policy structure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.

Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Delete the IAM role that is allowed access to the bucket.
Why it's wrong here
Deleting the role could affect other services that depend on it.
✗
Use AWS WAF to block the IP addresses of the compromised role.
Why it's wrong here
AWS WAF is for web traffic, not S3 access.
✗
Modify the bucket policy to deny all principals.
Why it's wrong here
The compromised role might have iam:PutRolePolicy permissions to revert.
✓
Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.
Why this is correct
A deny condition with an impossible IP address blocks all access effectively.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question