hardMultiple ChoiceObjective-mapped

CCSP Practice Question: Refer to the exhibit

Exhibit

{
  "eventSource": "s3.amazonaws.com",
  "eventName": "DeleteObject",
  "requestParameters": {
    "bucketName": "prod-customer-data",
    "key": "records/2023/01/taxinfo.csv"
  },
  "userIdentity": {
    "arn": "arn:aws:iam::123456789012:user/john.doe",
    "accountId": "123456789012"
  },
  "sourceIPAddress": "10.0.0.5",
  "responseElements": {
    "x-amz-id-2": "example"
  }
}

Refer to the exhibit. A security engineer reviews this CloudTrail log entry. The company has a policy that all deletion operations must be approved by the compliance team. What is the most likely compliance issue?

⚠ Common exam trap

ISC2 often tests the distinction between 'authorization' (who can perform an action) and 'approval' (a separate governance step), leading candidates to choose Option B when the real issue is the missing compliance approval artifact.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The deletion was performed without evidence of compliance team approval

The company policy explicitly requires compliance team approval for all deletion operations, and the CloudTrail log entry does not contain any evidence of such approval (e.g., no MFA context, no approval token, no IAM policy condition key indicating approval). CloudTrail logs record API calls but do not inherently capture external approval workflows; the absence of an approval artifact in the log indicates a policy violation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The deletion was performed from an internal IP address
Why it's wrong here
Internal IP is expected and not a compliance issue.
✗
The deletion was performed by a user who may not have authorization
Why it's wrong here
John.doe appears to be a legitimate IAM user, but authorization is separate from the approval policy.
✗
The log entry does not include the object's encryption status
Why it's wrong here
Encryption status is not relevant to deletion approval.
✓
The deletion was performed without evidence of compliance team approval
Why this is correct
The policy requires approval, but the log shows no approval step.

Go deeper

CCSP Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question