mediumMultiple ChoiceObjective-mapped

CISA Practice Question: Refer to the exhibit

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    }
  ]
}

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

⚠ Common exam trap

ISACA often tests the nuance that a policy granting anonymous access with a `Condition` block can still restrict the protocol, leading candidates to mistakenly think the bucket is fully public or that only authenticated users can access it.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Anonymous read access is allowed only over HTTPS

The S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Anonymous read access is allowed only over HTTPS
Why this is correct
The condition requires SecureTransport (HTTPS), and access is anonymous.
✗
The bucket is fully public for all actions
Why it's wrong here
Only GetObject is allowed, and it requires HTTPS.
✗
Write access is allowed over HTTP
Why it's wrong here
Write actions are not allowed, and HTTP is not required.
✗
Only authenticated users can access objects
Why it's wrong here
Principal '*' allows anonymous access, not just authenticated users.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CISA Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question