mediumMultiple ChoiceObjective-mapped

S3 Bucket Policy: Deny HTTP Requests

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

An administrator applies the above bucket policy to an S3 bucket containing sensitive data. What is the EFFECT of this policy?

Quick Answer

The correct answer is that the policy denies access if the request does not use HTTPS. This is because the S3 bucket policy uses a Deny effect paired with the aws:SecureTransport condition set to false, which explicitly blocks any request made over plain HTTP while allowing only encrypted HTTPS traffic. On the Certified Cloud Security Professional CCSP exam, this scenario tests your understanding of how to enforce encryption in transit using bucket policies, a key control for protecting sensitive data in cloud storage. A common trap is confusing this with a condition that allows HTTP; remember that setting SecureTransport to false triggers the Deny, so the policy acts as a gate that rejects unencrypted requests. For a quick memory tip, think of it as “Deny when not secure”—if the transport isn’t secure (HTTPS), access is denied.

⚠ Common exam trap

ISC2 often tests the distinction between `Deny` and `Allow` effects in S3 bucket policies, and the trap here is that candidates misread the condition as denying HTTPS instead of denying non-HTTPS, or they assume the policy grants public access because they overlook the absence of an `Allow` statement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Denies access if the request does not use HTTPS

The bucket policy uses a `Deny` effect with a condition `aws:SecureTransport` set to `false`, which means any request that does not use HTTPS (i.e., plain HTTP) is denied. This enforces encryption in transit for all access to the S3 bucket, ensuring sensitive data is not transmitted over an unencrypted channel. Option C correctly identifies that the policy denies access if the request does not use HTTPS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allows public read access
Why it's wrong here
The policy is a deny, not allow.
✗
Allows access only from specific IP addresses
Why it's wrong here
The condition checks SecureTransport, not IP.
✓
Denies access if the request does not use HTTPS
Why this is correct
It denies HTTP requests, enforcing HTTPS.
✗
Denies access if the request uses HTTPS
Why it's wrong here
It denies when SecureTransport is false, i.e., HTTP.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on CCSP

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

hard

A.It allows all access to the bucket.
B.It denies access to objects over HTTPS, but allows HTTP.
✓ C.It denies access to objects over HTTP, but allows HTTPS.
D.It denies all access to the bucket.

Why C: The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.