SCS-C02 Infrastructure Security Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. A user from IP address 203.0.113.10 tries to download an object using HTTP (not HTTPS). What will happen?

⚠ Common exam trap

The trap here is that candidates see the IP address matches the allow statement and assume the request is allowed, overlooking the explicit deny for HTTP that overrides the allow due to AWS IAM policy evaluation logic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The request is denied because HTTP is used.

The bucket policy includes a condition that denies access when the request uses HTTP (aws:SecureTransport equals false). Even though the IP address 203.0.113.10 matches the allowed IP range in the policy, the explicit deny for HTTP requests overrides the allow. Since the user is using HTTP, the request is denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request is allowed because the IP address matches the allow statement.
Why it's wrong here
Although the request originates from an IP that matches the allow statement's condition, that allow is not conclusive. The bucket policy also contains a separate explicit deny statement for requests using HTTP (or lacking HTTPS), and in IAM/S3 policy evaluation, an explicit deny takes precedence over any allow. Therefore the IP match does not make the request allowed.
✗
The request is denied because the IP is not in the allowed range.
Why it's wrong here
This answer is incorrect because the IP address does fall within the range specified in the allow statement; it is the transport protocol that is the problem. The request is being denied because the condition in the deny statement (a non-HTTPS/HTTP request) is satisfied, not because the IP is out of range. In fact, the IP is valid, so this reasoning misidentifies the actual cause of the denial.
✓
The request is denied because HTTP is used.
Why this is correct
The bucket policy includes an explicit deny statement that blocks any request where the transport protocol is HTTP, typically via a condition such as `aws:SecureTransport: false`. Since the request in question uses HTTP, that deny condition is met, and an explicit deny always overrides any allow statement in the policy. As a result, even a request from an otherwise permitted IP address is denied because of the insecure protocol.
✗
The request is allowed because the user is using a valid IP.
Why it's wrong here
This answer ignores the effect of the deny statement. While the IP address may be within the allowed range and thus satisfies the allow condition, the request is still subject to the explicit deny for HTTP requests. In AWS policy evaluation, an explicit deny takes precedence over any allow, so using a 'valid IP' (one allowed by the allow statement) does not grant access when the protocol condition is violated.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Infrastructure Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question