{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:ListBucket" ], "Resource":"arn:aws:s3:::inventory-artifacts-qa" }, { "Effect":"Allow", "Action":[ "s3:GetObject" ], "Resource":"arn:aws:s3:::inventory-artifacts-qa/*" } ] } is correct because it grants the bucket level permission for listing and the object level permission for reading objects so the reporting application can list the bucket and read any objects it contains.

S3 distinguishes bucket scoped actions and object scoped actions so the policy above separates the statements accordingly. Listing the bucket uses the bucket ARN while reading objects uses object ARNs that include a trailing /* and the two statements together provide read only access to the bucket and all of its contents.

{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:ListBucket", "s3:GetObject" ], "Resource":"arn:aws:s3:::inventory-artifacts-qa" } ] } is incorrect because it assigns s3:GetObject to the bucket ARN and GetObject requires object ARNs rather than the bucket ARN.

{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:ListBucket" ], "Resource":"arn:aws:s3:::inventory-artifacts-qa/*" }, { "Effect":"Allow", "Action":[ "s3:GetObject" ], "Resource":"arn:aws:s3:::inventory-artifacts-qa" } ] } is incorrect because the ARNs are inverted and ListBucket must target the bucket ARN while GetObject must target object ARNs.

{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "s3:ListBucket", "s3:GetObject" ], "Resource":"arn:aws:s3:::inventory-artifacts-qa/*" } ] } is incorrect because applying ListBucket to the object ARN pattern does not permit listing the bucket and ListBucket must target the bucket ARN.

Full AWS Practitioner Certification Question