hardMultiple ChoiceObjective-mapped

CCSP Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.
Bucket: my-company-logs
Region: us-east-1
Policy:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-company-logs/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/16"
        }
      }
    }
  ]
}

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

⚠ Common exam trap

ISC2 often tests the misconception that adding a Deny statement for the broader range (Option A) is the correct way to narrow access, but candidates fail to realize that Deny would block the intended subnet as well, whereas modifying the Condition value is the proper method to restrict an existing Allow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the Condition value to "aws:SourceIp": "10.0.1.0/24".

Modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add a Deny statement for the 10.0.0.0/16 range.
Why it's wrong here
This would deny access to the entire corporate network, including the security subnet.
✗
Add a Deny statement for IP addresses outside 10.0.1.0/24.
Why it's wrong here
While tempting because explicit `Deny` statements can be used to enforce security boundaries, this option is incorrect because a `Deny` for all IPs outside the security team's subnet would also block legitimate access from within the corporate network that is not part of the security team's specific subnet. The scenario requires allowing access from a specific subnet, not denying everything else. This approach is typically used to block known malicious IP ranges or to enforce a strict "deny by default" posture when combined with an explicit `Allow` for specific trusted sources.
✗
Remove the Condition element to allow access from any IP.
Why it's wrong here
This would open access to all IPs, violating the requirement.
✓
Change the Condition value to "aws:SourceIp": "10.0.1.0/24".
Why this is correct
This narrows the allowed IP range to the security subnet only.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CCSP Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question