Courseiva
← CCSP
Full test
mediumMultiple ChoiceObjective-mapped

CCSP Least Privilege Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Principal": "*"
    }
  ]
}

Refer to the exhibit. A security analyst finds this access control policy attached to a cloud storage bucket. What is the primary security issue?

⚠ Common exam trap

ISC2 often tests the distinction between 'public access' and 'all actions' — candidates mistakenly think 'all actions' is the issue, but the trap is that the policy only grants read access, yet the public principal makes it a severe data exposure risk regardless of the action scope.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy grants public read access to all objects.

The policy statement includes "Principal": "*" and "Effect": "Allow" without any condition restricting access, which grants public read access to all objects in the cloud storage bucket. This violates the principle of least privilege and exposes sensitive data to anyone on the internet, making it a critical security misconfiguration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The policy is missing a condition for encryption.

    Why it's wrong here

    While encryption conditions are important, the primary issue here is public access, not the lack of encryption condition.

  • ✗

    The policy does not specify a source IP.

    Why it's wrong here

    Source IP restrictions could limit access, but the core problem is that the policy allows anyone to read data.

  • ✗

    The policy allows all actions.

    Why it's wrong here

    Allowing all actions would be worse, but the policy specifically grants only read access; however, the public principal makes it a severe data exposure risk.

  • ✓

    The policy grants public read access to all objects.

    Why this is correct

    Correct. The policy allows any principal (public) to read objects, which is a critical misconfiguration.

About these practice questions

This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.