SCS-C02 Management and Security Governance Practice Question

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "10.0.0.0/16"
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

Refer to the exhibit. An IAM policy attached to a user allows s3:GetObject only from a specific IP range and denies all S3 actions if not using HTTPS. What happens when the user makes a GET request from IP 10.0.0.5 using HTTP?

⚠ Common exam trap

SCS-C02 often tests the misconception that an Allow for a matching IP will permit the request — candidates forget that an explicit Deny with a matching condition always wins.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Denied because the Deny statement matches

IAM policies evaluate all matching statements, and an explicit Deny always wins over any Allow. The policy denies all S3 actions when the request is not using HTTPS (aws:SecureTransport is false). Since the user made the request over HTTP, the Deny statement matches, so the request is denied regardless of the IP-based Allow.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allowed because the IP is in the range
Why it's wrong here
This conclusion ignores IAM's evaluation precedence: a request is implicitly denied by default, and an explicit Deny statement overrides any Allow. Even though the source IP satisfies the Allow statement's IpAddress condition, the Deny statement also matches the request and acts as an absolute block. In IAM, once a Deny applies, a matching Allow cannot reverse the decision, regardless of IP range.
✗
Allowed because the condition does not match
Why it's wrong here
This reasoning is invalid because the condition in the Allow statement does match—the request's source IP falls squarely within the specified range. However, matching the Allow condition only proves the Allow statement applies; it does not prevent a separate Deny statement from taking effect. In IAM, the presence of any matching Deny statement forces a final decision of Deny, so the request is not allowed.
✓
Denied because the Deny statement matches
Why this is correct
IAM decisions are made by evaluating all statements: if any applicable Deny statement matches the request, the result is Deny regardless of any matching Allow. Here, the Deny statement's condition is satisfied by the request, and because explicit Deny statements cannot be overridden by Allows, the effective decision is denied. This is not due to a default deny or missing allow, but an active, matching Deny.
✗
Denied because the IP is not in the range
Why it's wrong here
The premise is factually wrong because the source IP is within the range stated in the Allow policy. Denial is not caused by the IP falling outside the range; in fact, the Allow condition matches. The real cause is that a separate Deny statement in the same policy matches the request, and IAM's rule that Deny overrides Allow makes the final decision Deny.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Scored practice sessions

Short scored sets — answer, get feedback, read the explanation, move on.

Free SCS-C02 Practice Test 2 — 30 Questions→SCS-C02 Practice Test 5 — 25 Questions→

Practice by domain

Drill one exam section at a time instead of jumping between unrelated topics.

Management and Security Governance Infrastructure Security Threat Detection and Incident Response

Filter by question format

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Topic-level practice

One concept per page — questions, worked explanations, and a short concept guide.

Management and Security Governance practice questions SCS-C02 fundamentals practice questions SCS-C02 scenario practice questions

Where to go next

AWS Certified Security Specialty SCS-C02 exam guide Exam domains All SCS-C02 questions

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.

SCS-C02 Management and Security Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question