mediumMultiple ChoiceObjective-mapped

CISA Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

Exhibit:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}
```

Refer to the exhibit. An IS auditor finds this bucket policy attached to an S3 bucket storing sensitive customer data. What should the auditor recommend?

⚠ Common exam trap

The trap here is that candidates often focus on the actions or resource fields, overlooking the fact that the "Principal": "*" is the most critical security flaw, as it allows any entity to invoke the permitted actions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Restrict the principal to specific IAM roles or users.

The bucket policy grants access to any principal ("Principal": "*"), meaning any AWS user or anonymous user can perform the allowed actions on the bucket. For a bucket storing sensitive customer data, this is a critical security risk. Restricting the principal to specific IAM roles or users (Option D) ensures only authorized identities can access the bucket, aligning with the principle of least privilege.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Change the Resource to a different bucket.
Why it's wrong here
Resource is not the problem.
✗
Remove the Action "s3:GetObject and add "s3:PutObject".
Why it's wrong here
Changing action does not address the principal issue.
✗
Encrypt the bucket at rest.
Why it's wrong here
Encryption does not prevent unauthorized read access.
✓
Restrict the principal to specific IAM roles or users.
Why this is correct
The policy grants public read access; principal should be limited.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CISA Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question