hardMultiple Choice

ISC2 CC Practice Question: Refer to the exhibit

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::critical-data/*",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/SecurityAuditor"}
    }
  ]
}

Refer to the exhibit. Based on the JSON policy, what access does the SecurityAuditor role have?

⚠ Common exam trap

ISC2 often tests the distinction between bucket-level and object-level permissions, where candidates mistakenly assume that `s3:GetObject` on `/*` implies full access or write capabilities, but it only grants read access to objects.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Read-only access to all objects in the critical-data bucket.

The JSON policy grants the SecurityAuditor role the `s3:GetObject` action on the `arn:aws:s3:::critical-data/*` resource, which provides read-only access to all objects in the critical-data bucket. The `Effect` is set to `Allow`, and no other actions like `s3:PutObject` or `s3:DeleteObject` are included, so the role cannot write or delete objects. This matches the correct answer B.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
No access to any S3 resources.
Why it's wrong here
The policy's Action list grants s3:GetObject on critical-data, so read access exists; claiming none ignores the Allow statement entirely. It tempts when the Resource ARN looks malformed or the Effect reads Deny, but here the explicit Allow overrides the default implicit deny.
✓
Read-only access to all objects in the critical-data bucket.
Why this is correct
The JSON policy grants `s3:GetObject` and `s3:ListBucket` on the critical-data bucket's ARN, permitting retrieval and enumeration of every object without write, delete or overwrite permissions. This satisfies the stem's read-only constraint, since no mutating actions such as `PutObject` or `DeleteObject` appear in the statement.
✗
Write access to the critical-data bucket.
Why it's wrong here
The policy grants only s3:GetObject, a read action; no s3:PutObject, DeleteObject or similar write action appears in the Action list. It tempts because the role name SecurityAuditor suggests broad administrative reach, yet IAM evaluates the literal Action elements, not the role's title.
✗
Full access to the S3 bucket critical-data.
Why it's wrong here
The statement scopes Action to s3:GetObject alone, not s3:*, so full access is not granted; only object reads on critical-data are permitted. It tempts when the Resource uses a wildcard ARN, which looks like blanket access but constrains only the target, not the permitted actions.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

ISC2 CC Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question