Agile Frameworks and Methodologies →hardMultiple ChoiceObjective-mapped

CAPM Access Policy Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/confidential/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/project": "alpha"
        }
      }
    }
  ]
}

Refer to the exhibit. An Agile team used this project policy to control access to user stories in their project management tool. A developer reports that they cannot access a user story in the 'confidential' folder. Their request includes the tag 'confidential'. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The developer's request matches the condition in the Deny statement.

The developer's request matches the condition in the Deny statement. The project policy includes a Deny statement that applies when the request tag 'confidential' is present. Since the developer's request includes that tag, the Deny overrides the Allow, blocking access. Option B is incorrect because the developer is authorized by the Allow statement, but the Deny explicitly revokes that authorization for this specific condition.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy is malformed.
Why it's wrong here
The policy JSON is syntactically correct.
✗
The developer is not authorized to read any user stories.
Why it's wrong here
The Allow statement covers all objects, so the developer is authorized for non-confidential objects.
✓
The developer's request matches the condition in the Deny statement.
Why this is correct
The Deny statement explicitly blocks access when the tag condition is met.
✗
The user story is located in a different project.
Why it's wrong here
Region does not affect policy evaluation.

Go deeper

CAPM Access Policy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question