mediumMultiple Choice
CCSP Practice Question: A security analyst is using a cloud security…
A security analyst is using a cloud security posture management (CSPM) tool that reports a finding of "storage bucket publicly accessible." However, upon manual inspection, the bucket's ACL and bucket policy both restrict access to authorized users only. What is the most likely cause of the false positive?
⚠ Common exam trap
CCSP often tests the shared responsibility model and the difference between bucket-level and object-level permissions; candidates may assume the CSPM tool is wrong without considering object ACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket contains objects with public ACLs
A CSPM tool may flag a bucket as publicly accessible if any object within the bucket has a public ACL, even if the bucket-level ACL and policy are private. The tool evaluates the effective permissions of the bucket and its contents, and a single public object can trigger the finding. Manual inspection of only bucket-level settings would miss this.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket is in a different region
Why it's wrong here
Region placement affects latency, data residency and replication, not whether anonymous principals can read an object, so it cannot produce a public-access finding. It tempts when troubleshooting cross-region access failures, but the stem concerns an access-control evaluation, not geography.
- ✗
The bucket policy has a syntax error
Why it's wrong here
A syntax error would cause the policy to be rejected or ignored entirely, granting broader access than intended, which contradicts the observed restriction to authorised users. It tempts because malformed policies do cause exposure, but here the policy is functioning and another control is the cause.
- ✓
The bucket contains objects with public ACLs
Why this is correct
CSPM evaluates effective public access, not just bucket-level ACLs and policies. If individual objects carry public-read ACLs, the bucket is effectively exposed even though its own policy restricts access, so the tool flags it. The object-level ACLs are the actual cause.
- ✗
The CSPM tool is misconfigured
Why it's wrong here
A misconfigured CSPM tool would misreport every bucket, not one whose ACL and policy are demonstrably restrictive, so it fails to explain an isolated finding. It tempts because scanner misconfiguration genuinely causes false positives, but the stem points to a bucket-level setting overriding the policy.
Visual reference
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.