mediumMultiple ChoiceObjective-mapped

CCSP Secure transport policy Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "BoolIfExists": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Refer to the exhibit. A security engineer attaches this bucket policy to a cloud storage bucket. What does this policy accomplish?

⚠ Common exam trap

The trap is that candidates may confuse the HTTPS condition with IP-based or virtual network endpoint conditions, or mistakenly think the policy denies all requests because of the Deny effect, without reading the condition that limits the denial to non-HTTPS traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It denies all requests to the bucket that are not using HTTPS.

The bucket policy uses a condition that checks for HTTPS usage (secure transport) and an explicit Deny effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It allows only requests from a specific virtual network endpoint.
Why it's wrong here
It allows only requests from a specific virtual network endpoint. Incorrect. The policy denies non-HTTPS requests regardless of the source endpoint.
✓
It denies all requests to the bucket that are not using HTTPS.
Why this is correct
It denies all requests to the bucket that are not using HTTPS. Correct. The policy explicitly denies requests that do not meet the secure transport condition.
✗
It denies requests from IP addresses outside a specific range.
Why it's wrong here
It denies requests from IP addresses outside a specific range. Incorrect. The policy does not reference IP addresses.
✗
It denies all requests to the bucket.
Why it's wrong here
It denies all requests to the bucket. Incorrect. The policy only denies requests that are not using HTTPS, not all requests.

Go deeper

CCSP Secure transport policy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question