hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: The net effect of the policy shown in the exhibit…
Exhibit
Refer to the exhibit.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::confidential-data/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "10.0.0.0/8"
}
}
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "arn:aws:s3:::confidential-data/*"
}
]
}
```
A security analyst is reviewing an S3 bucket policy for an AWS environment.What is the net effect of the policy shown in the exhibit on requests from an IP address in the 10.0.0.0/8 range?
⚠ Common exam trap
CompTIA often tests the misconception that a Deny statement with a NotIpAddress condition effectively allows traffic from the specified IP range, when in reality it only denies traffic from outside that range, and without an explicit Allow, all traffic is denied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denies all S3 actions from all IP addresses.
The exhibit shows an AWS S3 bucket policy with a Deny effect for all S3 actions (s3:*) from any IP address (the condition block uses a NotIpAddress condition with the value 10.0.0.0/8, meaning the deny applies to all IPs that are NOT in that range). However, because the policy explicitly denies all actions for all IPs not in 10.0.0.0/8, and there is no corresponding Allow statement for the 10.0.0.0/8 range, the net effect is that all S3 actions are denied from all IP addresses, including those in 10.0.0.0/8. This is because AWS IAM policies default to implicit deny, and an explicit deny overrides any allow, so without an explicit allow for the 10.0.0.0/8 range, the deny applies universally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allows all S3 actions from the 10.0.0.0/8 range and denies from other IPs.
Why it's wrong here
The policy's explicit Deny statement, which applies to all S3 actions without any IP condition, takes precedence over any Allow statement. Therefore, even if an Allow statement permits actions from the 10.0.0.0/8 range, the unconditional Deny overrides it, rendering that Allow ineffective. The policy does not selectively deny *only* from IPs outside the specified range; it denies universally.
- ✓
Denies all S3 actions from all IP addresses.
Why this is correct
This option is correct because the policy contains an explicit Deny statement for all s3:* actions, which lacks any limiting conditions such as aws:SourceIp. According to AWS IAM policy evaluation logic, an explicit Deny always overrides any explicit Allow statements. Consequently, all S3 actions are denied for all principals, regardless of their source IP address, effectively nullifying any Allow rules.
- ✗
Denies all S3 actions except GetObject from the 10.0.0.0/8 range.
Why it's wrong here
This statement is incorrect because the explicit Deny action in the policy likely specifies s3:*, encompassing all S3 operations, including GetObject. Since the Deny is unconditional regarding IP addresses, it applies universally, meaning GetObject requests are also denied, even from the 10.0.0.0/8 range. The policy does not create an exception for GetObject.
- ✗
Allows GetObject requests from the 10.0.0.0/8 range and denies all other S3 actions.
Why it's wrong here
This option is incorrect because the fundamental principle of AWS IAM policy evaluation dictates that an explicit Deny always takes precedence over an explicit Allow. Even if there were an Allow statement specifically for GetObject from 10.0.0.0/8, the unconditional Deny for s3:* would still override it. Therefore, GetObject requests would also be denied, not allowed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Compensating Controls for Unpatched Vulnerabilities
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
S3 bucket policy
An S3 bucket policy is a JSON-based resource-based access control document that defines who can access an Amazon S3 bucket and its objects, and what actions they can perform.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.