hardMultiple ChoiceObjective-mapped
Why Relying on Private IP Ranges in S3 Bucket Policies Creates a Vulnerability
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::corporate-data/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "10.0.0.0/8"
}
}
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::corporate-data/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
```A security engineer is reviewing an S3 bucket policy for a bucket named 'corporate-data'. The policy is shown. Which of the following describes a vulnerability in this configuration?
Quick Answer
The correct choice is the one identifying that the Allow statement’s IP address condition uses a private IP range, which is ineffective for internet-facing buckets. This is because private IP ranges like 10.0.0.0/8 or 192.168.0.0/16 are non-routable on the public internet; any request from a public IP will fail the condition, effectively denying all external access, but the real S3 bucket policy private IP vulnerability is that the condition cannot be enforced for internet traffic, leaving the bucket either inaccessible or open to misconfiguration. On the CompTIA SecurityX CAS-004 exam, this tests your understanding of AWS IAM policy evaluation logic and the common trap of assuming private IPs provide security for public resources—a classic “security theater” mistake. A helpful memory tip: “Private IPs are for internal networks, not internet gatekeepers—if the bucket faces the web, a private IP condition is just a broken lock.”
⚠ Common exam trap
CompTIA often tests the misconception that private IP ranges can be used to restrict access to internet-facing S3 buckets, when in fact S3 only evaluates public source IPs, making such conditions ineffective or overly restrictive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Allow statement's IP address condition uses a private IP range, which is ineffective for internet-facing buckets
The Allow statement in the S3 bucket policy restricts access to a private IP address range (e.g., 10.0.0.0/8 or 192.168.0.0/16), which is non-routable on the public internet. Since the bucket is internet-facing, this condition is ineffective—any request from a public IP will fail the condition, effectively denying all external access, but the real vulnerability is that the policy relies on a private IP range that cannot be enforced for internet traffic, leaving the bucket either inaccessible or misconfigured. This misconfiguration can lead to unintended access if the condition is bypassed or if the bucket is intended to be public.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Deny statement allows anonymous uploads over HTTP
Why it's wrong here
The Deny statement denies all actions when SecureTransport is false.
- ✗
The Deny statement allows any anonymous user to upload objects to the bucket
Why it's wrong here
The Deny statement denies all actions, not just uploads.
- ✓
The Allow statement's IP address condition uses a private IP range, which is ineffective for internet-facing buckets
Why this is correct
Private IP ranges (10.0.0.0/8) are not source IPs from the internet; thus the condition never matches, making the Allow statement useless.
- ✗
The Allow statement permits access over insecure HTTP
Why it's wrong here
The Allow statement does not specify SecureTransport; it only checks IP. The Deny statement denies insecure transport.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A cloud security engineer is reviewing an AWS S3 bucket policy. What security issue does the policy contain?
hard- A.No server-side encryption is specified
- ✓ B.Public read access is allowed
- C.No version ID is specified in the resource
- D.No logging is enabled for the bucket
Why B: The policy allows any principal ('*') to perform s3:GetObject on the bucket, making the bucket publicly readable. This exposes objects to anyone on the internet. No encryption, logging, or versioning issues are indicated by this JSON snippet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.