Process — Managing Technical Aspects →hardMultiple ChoiceObjective-mapped

PMP Explicit Deny Practice Question

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

Refer to the exhibit. The project's access control policy allows read access only from the internal network (10.0.0.0/8) and denies access if not using an encrypted connection. A developer reports that they can access the repository from a machine with IP 10.0.0.5 using an encrypted connection. However, they cannot access it from a machine with IP 10.0.0.6 using an unencrypted connection. What is the most likely reason?

⚠ Common exam trap

It's easy for candidates to assume that if an IP is in the allowed range, all access is permitted, ignoring that an explicit Deny for a specific condition (like unencrypted connection) takes precedence over any Allow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Deny statement for unencrypted access overrides the Allow statement.

In policy evaluation logic, an explicit Deny always overrides any Allow. The policy includes a Deny statement that blocks access when an unencrypted connection is used. Since unencrypted access from 10.0.0.6 triggers this Deny, it overrides the Allow statement that permits access from the internal network, resulting in denied access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The Deny statement for unencrypted access overrides the Allow statement.
Why this is correct
In AWS IAM policy evaluation logic, an explicit Deny always takes precedence over an explicit Allow. If the S3 bucket policy contains an Allow statement for a specific IP range and a separate Deny statement for requests that are not using secure transport (e.g., aws:SecureTransport: false), the Deny will be enforced. This means even if a request originates from an allowed IP, it will be blocked if it attempts unencrypted access, as the Deny rule overrides the Allow.
✗
The policy requires both network and encrypted connection conditions to be met simultaneously.
Why it's wrong here
This statement misinterprets the policy structure. While an Allow statement might specify multiple conditions that must all be met for access to be granted, a separate Deny statement operates independently. The policy likely has an Allow for the network range and a separate Deny for unencrypted access. The Deny acts as an absolute block when its condition is met, rather than being a co-requisite within an Allow statement.
✗
The IP address 10.0.0.5 is not in the allowed range.
Why it's wrong here
The IP address 10.0.0.5 falls squarely within a common internal network CIDR block, such as 10.0.0.0/24, which is typically used to define an allowed range in S3 bucket policies. Therefore, this statement is incorrect because the IP address itself satisfies any network-based Allow condition present in the policy. The issue preventing access is not related to the IP's inclusion in the specified range.
✗
The IP address 10.0.0.6 is not in the allowed range.
Why it's wrong here
Similar to 10.0.0.5, the IP address 10.0.0.6 is indeed within a standard internal network range, like 10.0.0.0/24, and would satisfy any Condition specifying that CIDR block in an Allow statement. The problem preventing access from 10.0.0.6 is not its network origin, but rather a separate, overriding Deny statement that explicitly blocks requests lacking secure transport, even if the source IP is otherwise permitted.

Visual reference

Go deeper

PMP Explicit Deny Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question