mediumMultiple ChoiceObjective-mapped

CISA Has the storage bucket policy shown Practice Question

Exhibit

Refer to the exhibit.
```
{
  "PolicyName": "DataRetentionPolicy",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::corporate-data-archive/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

An organization has the storage bucket policy shown. Which of the following is the MOST likely intent of this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Prevent deletion of objects from the bucket over unencrypted connections.

The policy denies object deletion when the request is not over HTTPS (i.e., encrypted connection false), thereby blocking deletion over unencrypted connections but allowing deletion over HTTPS. Option B is incorrect because deletion over HTTPS is still allowed. Option C is incorrect because other actions like read are not restricted. Option D is incorrect because it does not specifically allow deletion only over HTTPS; it denies over unencrypted connections, so deletion over HTTPS is allowed implicitly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Prevent deletion of objects from the bucket over unencrypted connections.
Why this is correct
The policy denies s3:DeleteObject when SecureTransport is false.
✗
Prevent all deletion of objects from the bucket.
Why it's wrong here
Deletion over HTTPS is not denied.
✗
Prevent access to the bucket over HTTP.
Why it's wrong here
Only DeleteObject action is denied over HTTP; other actions allowed.
✗
Allow deletion only over HTTPS.
Why it's wrong here
The policy does not explicitly allow; it denies over HTTP, so deletion over HTTPS is implicitly allowed, but the intent is to block insecure deletion.

Go deeper

CISA Has the storage bucket policy shown Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question