mediumMultiple Choice

CISA Has the storage bucket policy shown Practice Question

Exhibit

Refer to the exhibit.
```
{
  "PolicyName": "DataRetentionPolicy",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::corporate-data-archive/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

An organization has the storage bucket policy shown. Which of the following is the MOST likely intent of this policy?

⚠ Common exam trap

CISA often tests whether candidates read the policy condition precisely — the trap is choosing 'prevent all deletion' because the policy mentions delete, ignoring the conditional clause that limits the denial to unencrypted connections only.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Prevent deletion of objects from the bucket over unencrypted connections.

The bucket policy uses a condition that denies the storage.objects.delete permission when the request is not over HTTPS (i.e., when secure transport is false), which specifically blocks object deletion over unencrypted connections while still allowing deletion over HTTPS. This is a targeted control to prevent accidental or malicious deletion on plaintext channels without disabling deletion entirely. The intent is therefore to prevent deletion of objects over unencrypted connections.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Prevent deletion of objects from the bucket over unencrypted connections.
Why this is correct
The bucket policy denies delete actions unless the request uses a secure transport, so object removal over unencrypted connections is refused. This matches the stated intent of preventing deletion of objects over unencrypted connections, which is the specific behaviour the policy enforces.
✗
Prevent all deletion of objects from the bucket.
Why it's wrong here
The policy denies requests where aws:SecureTransport is false, so HTTPS deletions still succeed; only unencrypted requests are refused. It is tempting because a Deny statement looks like a blanket block, but the condition narrows it to transport, and an unconditional deny on s3:DeleteObject would be needed to stop all deletion.
✗
Prevent access to the bucket over HTTP.
Why it's wrong here
A bucket policy condition on aws:SecureTransport enforces TLS for every request, so it blocks unencrypted HTTP access to objects and metadata alike; the intent is transport encryption, not an HTTP-specific ban. It is tempting because denying plain HTTP is a visible effect, but the policy's actual purpose is requiring HTTPS for all operations.
✗
Allow deletion only over HTTPS.
Why it's wrong here
The aws:SecureTransport condition applies to every action in the statement, not solely to delete operations; it enforces HTTPS for reads, writes and listings too. It is tempting because deletion is one covered action, but the policy's scope is transport security across the bucket, not a delete-only HTTPS rule.

Go deeper

CISA Has the storage bucket policy shown Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question