hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Refer to the exhibit
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "10.0.0.0/8"
}
}
}
]
}Refer to the exhibit. What is a potential security weakness in this policy?
⚠ Common exam trap
A common mix-up: candidates assume any IP-based condition is secure, failing to recognize that private IP ranges are non-routable and thus cannot enforce access control from the internet, leading them to overlook the fundamental network-layer limitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It grants access to a private IP range which is not routable over the internet
The policy grants access to a private IP range (e.g., 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) which is not routable over the internet. This means the condition is ineffective for controlling access from external sources, as private IP addresses are only meaningful within a local network and cannot be used to authenticate or authorize remote users. An attacker could spoof such an IP address from within the same network or bypass the restriction entirely if the policy is intended to restrict internet-based access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It does not specify a principal
Why it's wrong here
In IAM policies attached to a user/role, the principal is implicitly the entity.
- ✗
It allows all actions on the resource
Why it's wrong here
The action is limited to s3:GetObject, not all actions.
- ✓
It grants access to a private IP range which is not routable over the internet
Why this is correct
Private IP ranges are not seen as source IPs by AWS; the condition will never be satisfied for external requests.
- ✗
It uses a condition that can be bypassed
Why it's wrong here
The condition is specific to IP and is not easily bypassed.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.