CEH Wireless, IoT and Cloud Security Practice Question
A cloud security engineer wants to ensure that only authorized users can access an S3 bucket containing sensitive data. Which AWS service should be used to enforce fine-grained access control?
⚠ Common exam trap
Watch out — candidates often confuse encryption services (KMS) or logging services (CloudTrail) with access control, but only IAM provides the fine-grained authorization policies needed to control user actions on S3 resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Identity and Access Management (IAM)
AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is a managed service primarily designed for creating and controlling encryption keys used to encrypt data across various AWS services and within applications. While KMS keys can be protected by IAM policies that dictate who can use or manage the keys, KMS itself does not define or enforce the broader access control policies for AWS resources. Its role is data protection through encryption, not user authentication or authorization to resources.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an essential service for governance, compliance, and auditing of your AWS account. It continuously monitors and records API calls and related events made by users, roles, or AWS services in your account. CloudTrail provides a detailed history of actions, including who performed them, when, and from where, but it is purely a logging and monitoring tool and does not possess any capabilities to control or restrict access to AWS resources.
- ✗
AWS CloudFront
Why it's wrong here
AWS CloudFront operates as a global content delivery network (CDN) service, accelerating the delivery of web content and applications to users worldwide. Its primary function is to cache content at edge locations to reduce latency and improve performance. Although CloudFront can implement some access restrictions for the content it delivers, such as signed URLs or geo-restrictions, it is not designed to manage or enforce the fundamental identity and access permissions for users and roles interacting with core AWS services.
- ✓
AWS Identity and Access Management (IAM)
Why this is correct
AWS Identity and Access Management (IAM) is the core service for securely controlling access to AWS resources. It enables administrators to define granular permissions by creating users, groups, and roles, and attaching policies that specify which actions are allowed or denied on specific resources. IAM is fundamental for ensuring that only authorized entities can interact with AWS services and data, making it the correct solution for managing access control.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.