hardMultiple ChoiceObjective-mapped
CRISC Practice Question: The most significant risk identified by this…
Exhibit
Refer to the exhibit.
{
"PolicyName": "S3BucketAccessPolicy",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::critical-data/*"
}
]
}What is the most significant risk identified by this configuration?
⚠ Common exam trap
The trap here is that candidates may focus on internal threats (Option D) or encryption key management (Option B) instead of recognizing that a public bucket policy directly enables external unauthorized access, which is the most immediate and severe risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unauthorized access to sensitive data from the internet
The configuration exposes the S3 bucket to the internet without proper access controls, such as a bucket policy that restricts access to specific IP addresses or requires authentication. This means anyone on the internet can read or write objects in the bucket, leading to unauthorized access to sensitive data. The most significant risk is the direct exposure of confidential information to untrusted external actors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Denial of service attack on the S3 bucket
Why it's wrong here
The policy does not affect availability; it only defines read access permissions.
- ✗
Loss of encryption keys
Why it's wrong here
Encryption keys are not addressed in this policy; the risk is about access control, not key management.
- ✓
Unauthorized access to sensitive data from the internet
Why this is correct
The wildcard principal and lack of condition allow anyone to read objects, leading to data exposure.
- ✗
Data exfiltration by internal users
Why it's wrong here
The policy does not restrict access to internal users; it grants public access, so the primary risk is external, not internal.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.