hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud administrator receives an alert that a…
A cloud administrator receives an alert that a storage bucket containing sensitive customer data has been accessed from an unknown IP address at 3:00 AM. The bucket policy is configured to allow access only from the corporate VPN CIDR block (10.0.0.0/8). The administrator checks the access logs and sees that the request originated from 203.0.113.50, which is not within the allowed range. The bucket policy also includes a condition that restricts access to Secure Transport (SSL). What is the most likely reason the request succeeded despite the policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy has an Allow statement that permits all accesses using SSL, without restricting the source IP.
The most likely reason is that the bucket policy contains an Allow statement that grants access to all requests using Secure Transport (SSL) but does not include the source IP condition. This permissive statement overrides the IP restriction and allows the request from 203.0.113.50 if it uses SSL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The access logs are spoofed; the request actually came from a corporate IP.
Why it's wrong here
Assuming logs are accurate, the IP is external.
- ✓
The policy has an Allow statement that permits all accesses using SSL, without restricting the source IP.
Why this is correct
If the Allow statement only requires SSL but does not enforce the IP condition, then any SSL request would be allowed, bypassing the intended IP restriction.
- ✗
The unknown IP address is part of a misconfigured VPN client that still appears as the corporate CIDR.
Why it's wrong here
The IP is clearly outside the allowed range, so this is unlikely.
- ✗
The bucket policy is missing an explicit Deny statement for IP addresses outside the allowed range.
Why it's wrong here
While an explicit Deny is a best practice, the policy should still implicitly deny based on the Allow statement with condition; however, if the Allow condition has a logic flaw, it could allow unintended access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.