Courseiva
hardMultiple ChoiceObjective-mapped

CISM Practice Question: Refer to the exhibit

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::company-reports/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::company-reports/*"
    }
  ]
}

Refer to the exhibit. Based on the exhibit, what is the security implication of this cloud storage bucket policy?

⚠ Common exam trap

This question tests the distinction between explicit Deny with IP conditions and unrestricted Allow actions, where candidates mistakenly think a Deny on one action applies globally or that a missing Condition implies no access, rather than understanding that each action is evaluated independently.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Allows only users from 10.0.0.0/8 to read and write

The bucket policy includes a Condition block with NotIpAddress for both read and write actions, denying access from IP addresses outside the 10.0.0.0/8 range. This restricts both read and write operations to users from the internal network, making Option B correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Denies all access except from 10.0.0.0/8

    Why it's wrong here

    Ly states that all access is denied except from the range; the policy allows access from the range for both read and write.

  • Allows only users from 10.0.0.0/8 to read and write

    Why this is correct

    Correct. The policy uses a Condition to deny read and write for IPs outside 10.0.0.0/8, effectively allowing only users from that range to read and write.

  • Allows any authenticated user to read and write objects

    Why it's wrong here

    Incorrect. The policy restricts access to the internal network, not to any authenticated user.

  • Allows any user from internal network to read objects, but any user can write objects from anywhere

    Why it's wrong here

    Incorrect. Write access is also restricted to the internal network, not open to anyone from anywhere.

About these practice questions

Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.