hardMultiple ChoiceObjective-mapped

CRISC Practice Question: Based on the exhibit, what is the MOST…

Exhibit

Refer to the exhibit.

{
  "PolicyName": "IAMRoleAccessControl",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:role/AdminRole" },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential-bucket/*",
      "Condition": {
        "IpAddress": { "aws:SourceIp": "10.0.0.0/16" }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::public-bucket/*"
    }
  ]
}

Based on the exhibit, what is the MOST significant risk exposure?

⚠ Common exam trap

The trap here is that candidates may focus on the absence of deny statements (Option A) or the presence of admin access (Option B) as the primary risk, but the most significant exposure is the unrestricted public access to the public-bucket, which directly violates data confidentiality.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Public access to the public-bucket with no restrictions

Public access to the public-bucket with no restrictions means that anyone on the internet can read, write, or delete objects in that bucket. This is the most significant risk exposure because it directly exposes data to unauthorized users without any authentication or authorization controls, violating the principle of least privilege and potentially leading to data breaches or data loss.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not include deny statements, so all access is allowed
Why it's wrong here
By default, IAM policies are allow-based; deny statements are not required for security.
✗
The AdminRole can access both buckets
Why it's wrong here
AdminRole only has access to confidential-bucket per the policy.
✓
Public access to the public-bucket with no restrictions
Why this is correct
Anyone (Principal: *) can get objects from the public-bucket, posing a data leakage risk.
✗
The anonymous access to the confidential-bucket
Why it's wrong here
Confidential-bucket is restricted by principal and IP, so no anonymous access.

Go deeper

CRISC Practice Question: Based on the exhibit, what is the MOST…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question