hardMultiple ChoiceObjective-mapped

CRISC Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

=== AWS IAM Policy (JSON) ===
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::company-data/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
=== End of Policy ===

Refer to the exhibit. A risk manager is reviewing IAM policies for an S3 bucket used for sensitive data. This policy allows which of the following?

⚠ Common exam trap

Test-takers frequently assume a policy with 'Principal': '*' allows anonymous access, but in S3 bucket policies, '*' means any authenticated AWS user unless the policy explicitly includes a 'NotPrincipal' or the bucket is configured for public access; additionally, the condition on source IP is easy to overlook, leading to the mistaken belief that writes are allowed from any IP.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Users from the internal network (10.0.0.0/8) to write (PutObject) to the bucket

The policy statement includes a condition that restricts the s3:PutObject action to requests originating from the 10.0.0.0/8 IP range, and the principal is set to '*' (any authenticated user), meaning only authenticated users from the internal network can write to the bucket. The policy does not grant GetObject permissions, so reads are not allowed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Any user to read (GetObject) from the bucket
Why it's wrong here
Action is PutObject, not GetObject.
✗
Any user to write (PutObject) to the bucket from any IP address
Why it's wrong here
Condition restricts to 10.0.0.0/8 IP range.
✓
Users from the internal network (10.0.0.0/8) to write (PutObject) to the bucket
Why this is correct
The policy allows PutObject only from internal IPs.
✗
Users from the internal network to read (GetObject) from the bucket
Why it's wrong here
Action is PutObject, not GetObject.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CRISC Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question