hardMultiple ChoiceObjective-mapped

CRISC Default private access Practice Question

Exhibit

{
  "PolicyName": "S3-Bucket-Policy",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential-data/*"
    }
  ]
}

Refer to the exhibit. What is the PRIMARY risk identified from this policy?

⚠ Common exam trap

Watch out — candidates often confuse the primary risk (public read access to data) with secondary risks like logging or encryption, but the policy's explicit focus on 'private by default' directly targets unauthorized public exposure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Unrestricted public read access to confidential data

The policy statement 'All cloud storage buckets must be private by default' directly addresses the risk of public read access to confidential data. If a bucket is misconfigured as public, anyone on the internet can read its objects without authentication, leading to a data breach. This is the primary risk because the policy explicitly targets preventing unauthorized public exposure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Unrestricted public read access to confidential data
Why this is correct
This is correct because unrestricted public read access directly exposes confidential data.
✗
Inadequate logging
Why it's wrong here
Inadequate logging is a separate concern, but not the primary risk addressed by the policy.
✗
Lack of encryption for data at rest
Why it's wrong here
Lack of encryption is important but not directly targeted by the 'private by default' policy.
✗
Missing versioning
Why it's wrong here
Missing versioning does not directly cause data exposure.

Go deeper

CRISC Default private access Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question