hardMultiple ChoiceObjective-mapped

CAS-004 IAM Policy Conditions Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-sensitive-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
```

A security architect finds this IAM policy attached to an S3 bucket. Which of the following best describes a critical security flaw in this policy?

⚠ Common exam trap

Candidates may think the flaw is that the statement allows public access from the specified IP range, but in reality the condition never matches, so the statement never grants access. The real flaw is the incorrect operator, which breaks the intended access control.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition on the second statement uses StringEquals instead of IpAddress

The second statement uses StringEquals for the aws:SourceIp condition. StringEquals performs a literal string comparison, so the condition checks if the source IP exactly equals the string '10.0.0.0/8', which never happens. As a result, the condition always evaluates to false, and the Allow statement never grants any access. The critical security flaw is the misuse of the condition operator: StringEquals should be IpAddress to match IP ranges. This misconfiguration renders the intended IP restriction ineffective, and the bucket remains private (no public access is granted from the 10.0.0.0/8 range or anywhere else).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The condition on the second statement uses StringEquals instead of IpAddress
Why this is correct
Correct. The condition uses StringEquals instead of IpAddress, causing the condition to never evaluate to true. This is the critical security flaw.
✗
The second statement allows public access from the 10.0.0.0/8 IP range
Why it's wrong here
Incorrect. The second statement does not allow public access from the 10.0.0.0/8 range because the condition never matches. The policy actually denies access from that range unintentionally.
✗
The first statement allows EC2 to assume any role in the account
Why it's wrong here
Incorrect. The first statement likely allows EC2 to assume a role, but that is not the critical flaw discussed. The focus is on the condition operator.
✗
The policy should use a NotPrincipal element to restrict access
Why it's wrong here
Incorrect. Using a NotPrincipal element would change the principal logic, but the critical flaw here is the incorrect condition operator, not the principal element.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CAS-004 IAM Policy Conditions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question