CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  An attacker can read any object in the bucket without authentication

  Why this is correct

  The bucket policy explicitly grants the "s3:GetObject" action to "Principal: *". This configuration means that any user, including unauthenticated internet users, can retrieve and read the content of any object within the bucket, provided they know the object's key. This effectively makes all objects publicly readable, posing a significant data exposure risk.

• ✗

  An attacker can modify the bucket policy

  Why it's wrong here

  Modifying a bucket's policy requires the specific "s3:PutBucketPolicy" permission, which is a high-privilege action not granted by the existing policy. The policy only permits "s3:GetObject", which is solely for reading object data. Therefore, an attacker cannot alter, add, or remove any statements from the bucket's access policy.

• ✗

  An attacker can delete objects in the bucket

  Why it's wrong here

  Deleting objects within an S3 bucket necessitates the "s3:DeleteObject" permission, which is distinct from the "s3:GetObject" action. The current policy only authorizes the retrieval of object content. Without the explicit "s3:DeleteObject" permission, an attacker lacks the necessary authorization to remove any data from the bucket, preventing destructive actions.

• ✗

  An attacker can enumerate all objects in the bucket

  Why it's wrong here

  Enumerating or listing all objects in an S3 bucket requires the "s3:ListBucket" permission, which is not granted by the policy. While "s3:GetObject" allows reading a *specific* object if its key is known, it does not provide a mechanism to discover the names or keys of all objects present. An attacker cannot browse the bucket's contents without this distinct listing permission.

Go deeper

Related to this question