hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Based on the exhibit, which security issue does…
Exhibit
Refer to the exhibit.
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::mybucket/*"
}Based on the exhibit, which security issue does this IAM policy represent?
⚠ Common exam trap
CompTIA often tests the distinction between IAM policy syntax errors and security misconfigurations, and the trap here is that candidates may confuse a missing `Version` field (which is optional in most cases) with a security issue, when the real problem is the wildcard resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Overly permissive resource access
The IAM policy in the exhibit uses a wildcard (`*`) in the `Resource` element, granting access to all resources within the account. This violates the principle of least privilege by allowing overly permissive resource access, which could lead to unauthorized data exposure or modification. The correct answer is B because the policy does not restrict actions to specific resources, making it a classic example of excessive permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No versioning configured
Why it's wrong here
Versioning is not related to this policy.
- ✓
Overly permissive resource access
Why this is correct
Allowing all principals (*) to get any object in the bucket is a significant security risk.
- ✗
Missing server-side encryption
Why it's wrong here
The policy does not mention encryption, but the issue is permission.
- ✗
Insufficient logging and monitoring
Why it's wrong here
Logging is not discussed in the policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.