hardMultiple ChoiceObjective-mapped

CCSP Practice Question: Based on the audit log, why did the Decrypt call…

Exhibit

Refer to the exhibit.

CloudTrail log entry:
{
  "eventVersion": "1.05",
  "userIdentity": { "arn": "arn:aws:iam::123456789012:user/Alice" },
  "eventTime": "2023-08-15T14:30:00Z",
  "eventSource": "kms.amazonaws.com",
  "eventName": "Decrypt",
  "sourceIPAddress": "203.0.113.5",
  "resources": [{ "ARN": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" }],
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/Alice is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}

Based on the audit log, why did the Decrypt call fail?

⚠ Common exam trap

ISC2 often tests the distinction between key policy denials and key state issues; the trap here is that candidates confuse 'AccessDenied' errors with key disabled errors or invalid ciphertext errors, assuming the key is disabled or the ciphertext is corrupted when the real cause is a missing or explicit deny in the key policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The key policy denied access.

The Decrypt call failed because the key policy attached to the cloud key management service (KMS) key explicitly denied the cloud identity making the request. Audit logs show the error code 'AccessDenied' or 'UnauthorizedOperation', which indicates that the key policy did not grant the necessary decrypt permission to the principal. Even if the key is enabled and the ciphertext is valid, a restrictive key policy will block the operation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The encryption algorithm mismatch.
Why it's wrong here
Algorithm mismatch would cause a different error.
✗
The ciphertext was tampered.
Why it's wrong here
Tampering would cause an integrity check failure, not access denied.
✓
The key policy denied access.
Why this is correct
The error message indicates the user lacks authorization on the key.
✗
The key was disabled.
Why it's wrong here
A disabled key would produce a 'DisabledException' error.

Go deeper

CCSP Practice Question: Based on the audit log, why did the Decrypt call…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question