hardMultiple Choice
CAS-004 Practice Question: Based on the exhibit, which security issue does…
Exhibit
Refer to the exhibit.
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::mybucket/*"
}Based on the exhibit, which security issue does this IAM policy represent?
⚠ Common exam trap
CompTIA often tests the distinction between IAM policy syntax errors and security misconfigurations, and the trap here is that candidates may confuse a missing `Version` field (which is optional in most cases) with a security issue, when the real problem is the wildcard resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Overly permissive resource access
The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No versioning configured
Why it's wrong here
Versioning is an S3 bucket property governing object overwrite and delete behaviour, not an IAM policy element, so it cannot describe any issue within the policy shown in the exhibit. It is tempting because missing versioning genuinely enables permanent data loss or ransomware overwrites, and enabling it would be the right control when the scenario concerns bucket resilience rather than policy permissions.
- ✓
Overly permissive resource access
Why this is correct
The policy grants actions on a wildcard resource, so principals can reach every object of that type rather than only those required. This violates least privilege by broadening access far beyond the intended scope, exposing unrelated resources to unintended modification or disclosure.
- ✗
Missing server-side encryption
Why it's wrong here
An IAM policy governs identity permissions, not data-at-rest protection, so it cannot cause or represent missing server-side encryption. It is tempting because encryption gaps are a common audit finding, and IAM policies can restrict who may disable default encryption; that scenario concerns storage or database configuration, not the policy document itself.
- ✗
Insufficient logging and monitoring
Why it's wrong here
The policy's flaw concerns overly broad permissions, not missing logging or monitoring. Insufficient logging is the correct finding when CloudTrail trails or log delivery are absent or disabled; here the issue lies in what actions the policy grants, not in audit capture.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.