hardMultiple ChoiceObjective-mapped

CCSP Account Administrator Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:root"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::company-data/*"
    }
  ]
}

Refer to the exhibit. A cloud administrator is reviewing this storage access policy. What is the most significant security concern?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy grants access to the entire cloud account administrator [CORRECT]

Granting access to the account administrator of a cloud account is a major security risk because the administrator has unrestricted access and bypasses access management controls. While the policy lacks conditions and allows read access, the principal being the administrator is the most critical issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not include a condition for encryption [wrong]
Why it's wrong here
Missing encryption condition is a lesser concern compared to root access.
✗
The policy allows read access to the entire storage container [wrong]
Why it's wrong here
Allowing GetObject is not inherently dangerous; the principal is the issue.
✓
The policy grants access to the entire cloud account administrator [CORRECT]
Why this is correct
Root user access is dangerous because it cannot be limited by IAM.
✗
The policy does not specify a source IP [wrong]
Why it's wrong here
Missing source IP is a lesser concern than root access.

Go deeper

CCSP Account Administrator Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question