mediumMultiple ChoiceObjective-mapped

CISA Practice Question: The primary control weakness in this IAM policy?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential/*",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/developer"}
    }
  ]
}

What is the primary control weakness in this IAM policy?

⚠ Common exam trap

The trap here is that candidates often focus on missing security features like encryption or MFA, but the CISA exam emphasizes that the most critical IAM weakness is granting excessive permissions (over-privileged access) rather than missing optional controls.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Over-privileged access

The IAM policy grants broad permissions (e.g., `"Effect": "Allow", "Action": "*", "Resource": "*"`) without scoping to specific actions or resources, violating the principle of least privilege. This over-privileged access allows any authenticated principal to perform any operation (including destructive actions like `iam:DeleteRole` or `s3:DeleteBucket`) across all resources, creating a severe security risk. The primary weakness is the lack of fine-grained access control, not the absence of encryption, MFA, or logging.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Over-privileged access
Why this is correct
The role has broad access to all objects without conditions.
✗
No encryption requirement
Why it's wrong here
Encryption is not specified but is not the primary weakness.
✗
MFA not required
Why it's wrong here
MFA could be added as a condition, but the primary weakness is over-privilege.
✗
Lack of logging
Why it's wrong here
Logging is not part of the policy.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CISA Practice Question: The primary control weakness in this IAM policy?

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question