Exam AWS Certified Security - Specialty topic 1 question 420 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 420
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A security engineer needs to create an Amazon S3 bucket policy that restricts access to specific IP address ranges. The policy must allow only IP addresses in the range 10.24.34.0/23 to access the S3 bucket DOC-EXAMPLE-BUCKET and its objects. The policy must deny access to DOC-EXAMPLE-BUCKET from other IP address ranges.

IAM policies will control the actions that principals can take in the S3 bucket.

Which policy meets these requirements?

Show Suggested Answer

Suggested Answer: B 🗳️

by docjames81 at Nov. 21, 2022, 3:30 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

docjames81

Highly Voted 2 years, 6 months ago

Selected Answer: B

I vote B, AWS docs have it as an example of this use case: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-3

upvoted 9 times

...

Nuha_23

Most Recent 1 year, 9 months ago

Selected Answer: B

See : Restrict access to a specific IP address range https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

upvoted 1 times

...

Artaggedon

2 years, 2 months ago

Selected Answer: D

Unless I'm missing something (and if so, please let me know), answer is D and heres why: A - INCORRECT - Allows IP not it the CIDR, which means allows everyone but the CIDR. Just the opposite of what we want. B - INCORRECT - Denies access to everyone who is not in the CIDR, BUT it doesn't allow access the IPs inside the CIDR, which is something required. C - INCORRECT - Denies everyone who is in the CIDR, which is bad, but not as bad as A. D - CORRECT - Allows IP's in the CIDR, which we want. And, because AWS has a default policy of DENY if we don't have and explicit DENY, the policy denies access to people outside the CIDR by omission. It's true that D doesn't have an explicit deny, but it's the only one that furfills the request of granting access to the CIDR and leaving outside the others. But, please, correct me if I'm wrong

upvoted 2 times

Artaggedon

2 years, 2 months ago

Let me correct D: Allows IP's in the CIDR, which we want. And, because AWS has a default policy of DENY if we don't have and explicit *ALLOW*, the policy denies access to people outside the CIDR by omission.

upvoted 2 times