SCS-C02 Threat Detection and Incident Response Practice Question

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
```

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow access only from the corporate network (10.0.0.0/8). What is a potential security issue with this policy?

⚠ Common exam trap

Many exam-takers assume an IP address condition in a bucket policy automatically implies authenticated access, but AWS explicitly allows anonymous access when `Principal: "*"` is used, even with IP restrictions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy allows anonymous access from the specified IP range.

The policy's `Principal: "*"` element allows anonymous access from any IP address, and the `Condition` block only restricts the source IP to 10.0.0.0/8. This means any unauthenticated request originating from within the corporate network (10.0.0.0/8) is permitted, effectively granting anonymous access to the S3 bucket. The intended goal of restricting access to authenticated corporate users is not achieved, as no `aws:userid` or `aws:username` condition is enforced.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy allows anonymous access from the specified IP range.
Why this is correct
The policy's Principal element is set to "*", which means every principal—whether an authenticated IAM identity or an anonymous internet client—is a match. The only limiting factor is the IpAddress condition, so any request originating from the specified CIDR range is allowed without requiring AWS credentials. This effectively exposes the objects to anonymous read access from that IP range, which is exactly the vulnerability described.
✗
The policy grants access to all actions, not just GetObject.
Why it's wrong here
The Action element explicitly lists s3:GetObject, not s3:* or s3:Get*. This restricts permissions to retrieving individual objects; it does not grant PutObject, DeleteObject, ListBucket, or any other S3 action. Since the statement is scoped to a single action, the claim that it grants access to all actions is factually incorrect.
✗
The policy resource is incorrect; it should be the bucket ARN without the /*.
Why it's wrong here
For object-level operations like GetObject, the resource ARN must be bucket-name/* to target the objects within the bucket. A bare bucket ARN (without the /*) refers only to the bucket object itself and would not match any object keys, causing the get request to be denied because the resource does not match. The /* suffix is required and is not a mistake.
✗
The policy does not include a condition to require MFA.
Why it's wrong here
An absent MFA condition does not constitute a policy error—MFA is an optional security control to add only when the requirement is explicitly desired. Here the intent is to allow access based on source IP address, and the policy fulfills that intent. To enforce MFA, the policy would need a condition such as "Bool": {"aws:MultiFactorAuthPresent": "true"}, but its omission is not a defect.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Scored practice sessions

Quick scored rounds with instant marking and a written explanation per question.

SCS-C02 Practice Questions 2 — 50 Questions→SCS-C02 Practice Exam 3 — 20 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Threat Detection and Incident Response Data Protection Management and Security Governance

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Threat Detection and Incident Response practice questions Security Logging and Monitoring practice questions SCS-C02 scenario practice questions Data Protection practice questions

Keep going

Exam domains All Amazon Web Services practice questions Study guide

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.

SCS-C02 Threat Detection and Incident Response Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question