mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: Refer to the exhibit
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?
⚠ Common exam trap
ISC2 often tests the misconception that adding encryption requirements alone secures a bucket, when in fact the policy must also explicitly deny anonymous access by using a Deny statement with a NotPrincipal or by restricting the Principal to specific AWS accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy allows anonymous read access to all objects in the bucket
The S3 bucket policy includes an Allow effect with a Principal of '*' and a condition that only denies unencrypted requests, but it does not explicitly deny anonymous access. Because the Allow statement grants s3:GetObject to all principals (including anonymous users) when the request is encrypted, any unauthenticated user can read objects in the bucket over HTTPS. This is the primary risk: anonymous read access to all objects, exposing sensitive customer data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy does not restrict access to specific IP addresses
Why it's wrong here
While IP restriction is missing, the critical risk is that the bucket is publicly accessible.
- ✓
The policy allows anonymous read access to all objects in the bucket
Why this is correct
The principal is '*' meaning anyone can read objects if they meet the condition.
- ✗
Any unencrypted request is denied, which could cause data loss if encryption fails
Why it's wrong here
Denial of unencrypted requests is a security control, not a risk.
- ✗
The policy requires server-side encryption, but does not enforce it for all requests
Why it's wrong here
The condition enforces encryption for GET requests.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.