mediumMultiple Choice
CCSP Secure transport policy Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"BoolIfExists": {
"aws:SecureTransport": "false"
}
}
}
]
}Refer to the exhibit. A security engineer attaches this bucket policy to a cloud storage bucket. What does this policy accomplish?
⚠ Common exam trap
The trap is that candidates may confuse the HTTPS condition with IP-based or virtual network endpoint conditions, or mistakenly think the policy denies all requests because of the Deny effect, without reading the condition that limits the denial to non-HTTPS traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It denies all requests to the bucket that are not using HTTPS.
The bucket policy uses a condition that checks for HTTPS usage (secure transport) and an explicit Deny effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It allows only requests from a specific virtual network endpoint.
Why it's wrong here
The policy's Condition keys reference source IP addresses, so it constrains network origin rather than a virtual network endpoint. Endpoint-based restrictions use a different condition key. It is tempting because both approaches restrict network access, and an endpoint condition would be correct when access must originate from a specific VPC endpoint.
- ✓
It denies all requests to the bucket that are not using HTTPS.
Why this is correct
The policy's `aws:SecureTransport` condition evaluates to false for plain HTTP requests, triggering an explicit Deny. This enforces encryption in transit for every request to the bucket, satisfying the stem's requirement that unencrypted access be blocked regardless of principal or action.
- ✗
It denies requests from IP addresses outside a specific range.
Why it's wrong here
The condition matches a permitted source range and allows those requests; it does not deny addresses outside that range. It is tempting because the effect resembles IP filtering, and an explicit Deny with a NotIpAddress condition would be correct when the requirement is to block everything outside the range.
- ✗
It denies all requests to the bucket.
Why it's wrong here
The policy grants an Allow for requests matching the stated condition, so it does not deny everything; unmatched requests fall through to the default deny. It is tempting because an explicit Deny statement would indeed block all requests, and that would be the correct construction when the intent is to refuse every action on the bucket.
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.