hardMultiple ChoiceObjective-mapped

ISC2 CC Practice Question: Refer to the exhibit

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::critical-data/*",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/SecurityAuditor"}
    }
  ]
}

Refer to the exhibit. Based on the JSON policy, what access does the SecurityAuditor role have?

⚠ Common exam trap

ISC2 often tests the distinction between bucket-level and object-level permissions, where candidates mistakenly assume that `s3:GetObject` on `/*` implies full access or write capabilities, but it only grants read access to objects.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Read-only access to all objects in the critical-data bucket.

The JSON policy grants the SecurityAuditor role the `s3:GetObject` action on the `arn:aws:s3:::critical-data/*` resource, which provides read-only access to all objects in the critical-data bucket. The `Effect` is set to `Allow`, and no other actions like `s3:PutObject` or `s3:DeleteObject` are included, so the role cannot write or delete objects. This matches the correct answer B.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
No access to any S3 resources.
Why it's wrong here
Access is explicitly granted.
✓
Read-only access to all objects in the critical-data bucket.
Why this is correct
GetObject grants read access.
✗
Write access to the critical-data bucket.
Why it's wrong here
Write actions like PutObject are not allowed.
✗
Full access to the S3 bucket critical-data.
Why it's wrong here
Only GetObject is allowed, not PutObject or Delete.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

ISC2 CC Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question