Courseiva
← CAS-005
Full test
mediumMultiple Choice

CAS-004 Practice Question: Based on the exhibit, what is the primary purpose…

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::corporate-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "10.0.0.0/16",
            "192.168.1.0/24"
          ]
        }
      }
    }
  ]
}

Based on the exhibit, what is the primary purpose of the condition in this IAM policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Restrict access to requests originating from the specified IP ranges

The condition in the IAM policy uses the `aws:SourceIp` key to restrict access to requests originating from the specified IP ranges. Option A is incorrect because the condition does not address encryption in transit. Option B is incorrect because the policy does not allow all traffic; it allows only requests from the specified IPs. Option C is incorrect because the policy is an allow with a condition, not a deny statement. The condition effectively limits which IPs can perform the allowed actions, making D the primary purpose.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Enable encryption in transit for the S3 bucket

    Why it's wrong here

    Encryption in transit is enforced through aws:SecureTransport or TLS requirements, not the condition shown. It tempts because S3 policies commonly include encryption-related conditions, but those govern data at rest via keys or in transit via transport checks, not this condition's actual purpose.

  • ✗

    Allow all incoming traffic to the S3 bucket

    Why it's wrong here

    An S3 bucket policy condition cannot grant inbound network traffic; S3 is object storage accessed via API calls, not a network endpoint accepting connections. It tempts because bucket policies do control access, but through principals, actions and conditions such as source IP or VPC endpoint, never traffic allowance.

  • ✗

    Deny access from the specified IP ranges

    Why it's wrong here

    A Deny statement would be needed to block the specified IP ranges; a condition inside an Allow statement merely narrows when that Allow applies, it does not itself deny. It tempts because conditions frequently reference IP ranges, but they restrict the grant rather than create a denial.

  • ✓

    Restrict access to requests originating from the specified IP ranges

    Why this is correct

    The condition compares the request's source IP against defined ranges, permitting access only when the origin falls within them. This satisfies the policy's constraint of scoping permissions geographically or to trusted networks, rejecting requests from any other address.

About these practice questions

One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.