mediumMultiple ChoiceObjective-mapped

CCSP Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

exhibit:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

⚠ Common exam trap

ISC2 often tests the distinction between an explicit Deny and an implicit Deny — candidates mistakenly think a condition-based Allow is the same as a Deny for non-matching IPs, but the policy only denies implicitly, not explicitly.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy allows GetObject requests only from the specified IP range

The S3 bucket policy includes a Condition block using the IpAddress condition key to restrict the aws:SourceIp to a specific IP range. The Effect is Allow, and the Action is s3:GetObject, so only GET requests from that IP range are permitted. This makes option B correct because the policy explicitly allows GetObject requests from the specified IP range while implicitly denying all other access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy grants full administrative access to the bucket
Why it's wrong here
Only s3:GetObject is allowed, not administrative actions.
✓
The policy allows GetObject requests only from the specified IP range
Why this is correct
Correct. The condition aws:SourceIp limits the Allow effect to that IP range.
✗
The policy denies all access from the specified IP range
Why it's wrong here
The effect is Allow, not Deny.
✗
The bucket is publicly accessible to any IP address
Why it's wrong here
The condition restricts access to the specified IP range.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CCSP Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question