easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A security analyst reviews the bucket policy above
Exhibit
Refer to the exhibit. The following is an excerpt from an AWS S3 bucket policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}A security analyst reviews the bucket policy above. What is the primary security concern?
⚠ Common exam trap
ISC2 often tests the distinction between read and write permissions in bucket policies, so candidates may mistakenly choose public write access (Option D) when the policy clearly shows read access, or they may overthink the missing Condition element (Option C) as the primary issue rather than the explicit public Principal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy allows public read access to all objects
The bucket policy grants public read access to all objects via a Principal set to '*' and an Effect of 'Allow' on the s3:GetObject action. This means any unauthenticated user on the internet can list and download objects in the bucket, leading to potential data exposure. The primary security concern is unauthorized data disclosure, which violates the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The bucket policy allows public read access to all objects
Why this is correct
Allowing GetObject to anonymous users makes all objects publicly readable.
- ✗
The bucket policy uses an outdated version
Why it's wrong here
Version 2012-10-17 is current.
- ✗
The bucket policy is missing a Condition element
Why it's wrong here
While adding conditions is a best practice, the primary issue is public access.
- ✗
The bucket policy allows public write access to all objects
Why it's wrong here
The policy grants GetObject (read), not write.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.