hardMultiple ChoiceObjective-mapped

CCSP Practice Question: The exhibit shows a key policy for a customer…

Exhibit

Refer to the exhibit.

```
# Example of cloud KMS key policy (JSON)
{
  "Version": "2012-10-17",
  "Id": "key-default",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}
```

The exhibit shows a key policy for a customer master key (CMK) in a cloud KMS. An administrator wants to prevent the AppRole from using the key to decrypt data. Which change to the policy would accomplish this?

⚠ Common exam trap

ISC2 often tests the principle of least privilege and the precise modification of permissions, where candidates may incorrectly choose to add a deny statement (Option A) instead of simply removing the specific action from the allow list, misunderstanding that an explicit deny is not the most efficient or correct way to revoke a permission that was previously granted.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remove "kms:Decrypt" from the action list in the AppRole statement.

The AppRole's current policy statement explicitly includes 'kms:Decrypt' in the action list, granting it permission to decrypt data. By removing 'kms:Decrypt' from that action list, the AppRole retains its other allowed actions (such as kms:Encrypt) but can no longer perform decryption operations. This is the most precise and least disruptive change, as it only removes the specific permission needed to prevent decryption without affecting other allowed actions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add a deny statement for AppRole with effect "Deny" for kms:Decrypt.
Why it's wrong here
A deny statement would also block decryption, but it's less direct than modifying the existing allow statement.
✗
Remove the entire "Allow use of the key" statement.
Why it's wrong here
This would remove all permissions for AppRole, including encryption, which may be too restrictive.
✗
Change the AppRole action list to include only kms:Encrypt.
Why it's wrong here
This is similar to B but also removes ReEncrypt and GenerateDataKey; B is more precise.
✓
Remove "kms:Decrypt" from the action list in the AppRole statement.
Why this is correct
Decrypt is the specific action needed for decryption. Removing it prevents decryption but allows encryption.

Go deeper

CCSP Practice Question: The exhibit shows a key policy for a customer…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question