hardMultiple Choice
CISSP Practice Question: A cloud storage bucket access policy grants all…
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::bucketA/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "192.0.2.0/24"
}
}
},
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::bucketA/*"
}
]
}A cloud storage bucket access policy grants all principals permission to write objects. What is the primary security risk of this policy?
⚠ Common exam trap
The trap here is that candidates focus on the obvious public read access and overlook the more dangerous public write permission, which is the primary security risk in this policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It allows any IP to write objects
The primary security risk is that the policy allows any IP to write objects. Public write access can enable unauthorized data modification, upload of malicious content, storage abuse, and potential data breaches. Public read access is also risky, but write access is more dangerous because it permits altering or injecting data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It only allows read from a specific IP
Why it's wrong here
This statement is partially true regarding read access, as the policy explicitly restricts `s3:GetObject` actions to a specific IP range (`"aws:SourceIp": ["192.0.2.0/24"]`). However, the question asks for the *security risk* of the S3 bucket policy. While read access is restricted, the policy's primary security flaw lies elsewhere, making this an incomplete answer to the question about the *risk*.
- ✗
It allows public read access to all objects
Why it's wrong here
This statement is incorrect because the S3 bucket policy explicitly includes a condition that restricts `s3:GetObject` actions. The `Condition` block specifies `"aws:SourceIp": ["192.0.2.0/24"]`, meaning only requests originating from that specific IP range are permitted to read objects. Therefore, public read access is explicitly denied, making this option false.
- ✗
It denies all access
Why it's wrong here
This statement is incorrect because the S3 bucket policy clearly defines two `Allow` statements. The first statement permits `s3:GetObject` actions from a specific IP range, and the second statement permits `s3:PutObject` actions without any IP restriction. Since the policy explicitly grants permissions for both read and write operations under certain conditions, it does not deny all access.
- ✓
It allows any IP to write objects
Why this is correct
This statement accurately identifies the primary security risk within the provided S3 bucket policy. The second `Statement` block explicitly allows the `s3:PutObject` action, which enables users to upload new objects to the bucket. Crucially, this `Allow` statement lacks any `Condition` to restrict the source IP address, meaning any IP address can successfully perform `PutObject` operations, leading to potential unauthorized data injection or storage abuse.
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.