SCS-C02 Infrastructure Security Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/16"
        }
      }
    }
  ]
}

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

⚠ Common exam trap

The trap here is that candidates may overlook the `Condition` block and assume the policy allows the action because `s3:GetObject` is listed, failing to realize that the source IP condition can override the allow even when the action is explicitly permitted.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The source IP condition does not match the user's actual IP address

The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The bucket policy overrides the IAM policy
Why it's wrong here
In AWS, IAM identity-based policies and S3 bucket policies are evaluated together as a combined set, and an Allow from either grants access unless an explicit Deny exists somewhere. A bucket policy cannot override an IAM policy simply because it is a resource policy—there is no automatic precedence. Since no bucket policy containing a Deny statement is shown, this explanation does not account for the denied access.
✗
The policy does not allow the s3:GetObject action
Why it's wrong here
The policy statement explicitly includes "Effect": "Allow", "Action": "s3:GetObject", and a resource, so the s3:GetObject action is clearly granted—it is not missing from the policy. The problem is that the statement also contains an aws:SourceIp condition that must be satisfied before the Allow takes effect. The condition is the gate that is failing, not the action definition.
✓
The source IP condition does not match the user's actual IP address
Why this is correct
The policy condition uses the aws:SourceIp global condition key and requires the request to originate from 10.0.0.0/16, a private RFC 1918 CIDR range. IAM compares this against the actual source IP recorded in the request, so if the IAM user is connecting from outside that range—for example, from a public internet address—the condition fails. When a condition fails, the Allow statement is skipped and the request is implicitly denied.
✗
The user is not assuming the correct IAM role
Why it's wrong here
This policy is attached directly to the IAM user, so the user can use it with their own credentials without assuming any role. Role assumption is only needed when the permission is on an IAM role and the user must call sts:AssumeRole to obtain temporary credentials. Here the IAM principal is already the policy holder, so the failure is not caused by an identity mismatch; the source IP condition is still not satisfied.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Infrastructure Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question