Business Analysis Frameworks →mediumMultiple ChoiceObjective-mapped

CAPM IP-based access control Practice Question

Exhibit

// Sample JSON policy document for access control
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

A business analyst reviews this policy for a data storage solution. What is the primary business requirement being addressed?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Ensure that only users from a specific IP range can read data.

The policy grants read access to objects only when the request originates from a specific IP address range (e.g., 192.0.2.0/24), directly addressing the primary business requirement to control read access based on IP. Option A is incorrect because the policy does not allow any user to read objects; it restricts read access by IP. Option B is incorrect because while deletion is denied, it is not the primary requirement. Option D is incorrect because the policy does not restrict access to a single user but rather to a specific IP range.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allow any user to read data from the storage location.
Why it's wrong here
The policy does not allow any user to read objects; it restricts read access by IP.
✗
Prevent all users from deleting data in the storage location.
Why it's wrong here
While deletion is denied, it is not the primary requirement.
✓
Ensure that only users from a specific IP range can read data.
Why this is correct
The policy grants read access to objects only when the request originates from a specific IP address range, directly addressing the primary business requirement to control read access based on IP.
✗
Restrict access to the storage location to a single user.
Why it's wrong here
The policy does not restrict access to a single user but rather to a specific IP range.

Go deeper

CAPM IP-based access control Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question