Identify the Access Control Required to Implement Data Permissions for ECS Client Access ECS-DESIGN Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An administrator is troubleshooting why a user is denied access to an object even though the bucket policy grants read access. The object ACL also grants read access to the user. However, the user is part of a group that has an explicit deny on the bucket. What is the most likely reason for the denial?

   • AThe user is not authenticated
   • BThe object ACL is misconfigured
   • CThe group-level deny overrides the bucket policy and object ACL allows
   • DThe bucket policy is misconfigured
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company wants to enforce a policy that allows only users from a specific IP range to access a particular bucket, while all other users are denied. Which mechanism should be used?

   • ABucket policy with a condition based on source IP
   • BObject ACL with IP-based grants
   • CIAM role with IP restriction
   • DLDAP group membership with IP filter
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the difference between the 'read' and 'list' permissions in ECS?

   • ARead allows overwriting objects, while list allows deleting objects
   • BRead allows downloading objects, while list allows uploading objects
   • CRead and list are identical permissions with different names
   • DRead allows viewing object contents, while list allows viewing the bucket's contents
   Reveal Solution Discussion Select an answer first
5. 19application · hard

   A developer needs to allow a partner application to write new objects to a specific bucket but prevent it from overwriting or deleting existing objects. Which permission configuration should be applied?

   • AGrant write permission on the bucket and deny delete permission
   • BGrant read and write permissions on the bucket
   • CGrant create-object permission and deny overwrite and delete permissions
   • DGrant full control to the partner application
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What happens after ECS authenticates a client request?

   • AECS logs the request and denies it by default
   • BECS encrypts the request and sends it to the storage node
   • CECS immediately grants the request without further checks
   • DECS checks the client's permissions to determine if the request is allowed
   Reveal Solution Discussion Select an answer first