SOA-C02 Networking and Content Delivery Practice Question

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "192.0.2.0/24"
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": "192.0.2.0/24"
                }
            }
        }
    ]
}
```

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The bucket ACL allows public read access, overriding the bucket policy Deny.

The bucket policy shown only allows access from the 192.0.2.0/24 IP range. However, if the bucket also has a bucket ACL that grants public read access to everyone, users from other IP ranges can read objects via the ACL. Bucket policies and ACLs are evaluated independently; an Allow in the ACL can grant access even if the policy does not explicitly deny it. Since there is no explicit Deny in the bucket policy against other IPs, the ACL's public read grant allows access from all IP ranges, overriding the intent of the policy's Allow restriction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The bucket is not configured to use the bucket policy.
Why it's wrong here
Bucket policies are always evaluated if present.
✗
The bucket policy is malformed and is not being applied.
Why it's wrong here
The policy is syntactically correct.
✗
The Condition element in the Allow statement is incorrectly formatted.
Why it's wrong here
The condition is correctly formatted.
✓
The bucket ACL allows public read access, overriding the bucket policy Deny.
Why this is correct
Bucket ACLs are evaluated before bucket policies, and if an ACL grants access, it can override a Deny in the policy.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Networking and Content Delivery Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question