CLF-C02 Security and Compliance Practice Question
A company recently migrated to AWS and needs to ensure their S3 buckets are not publicly accessible. Which combination of controls best prevents accidental public S3 exposure?
⚠ Common exam trap
Test-takers frequently confuse data protection features (encryption, versioning, acceleration) with access control mechanisms, leading them to select options that secure data in transit or at rest but do not prevent public exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Block Public Access at the account level and use AWS Config to detect violations
S3 Block Public Access at the account level provides a centralized, enforceable guardrail that prevents any bucket or object from being made publicly accessible, overriding any bucket-level policies or ACLs. AWS Config can then continuously monitor for configuration violations, such as a bucket policy that grants public access, and trigger remediation or alerts. Together, these controls create a defense-in-depth approach that both prevents accidental exposure and detects non-compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 server-side encryption on all buckets
Why it's wrong here
SSE protects data at rest by encrypting objects before they are stored and decrypting them when accessed with valid credentials. However, S3 evaluates authorization before returning any object, so if a bucket policy grants public read access, anyone can retrieve the plaintext object—after S3 transparently decrypts it using the service's or AWS KMS-managed keys. Encryption therefore mitigates the impact of physical media theft or unauthorized backend access, but it does nothing to stop a misconfigured policy from exposing data over the internet.
- ✓
Enable S3 Block Public Access at the account level and use AWS Config to detect violations
Why this is correct
Block Public Access at the account level enforces four settings—BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets—that override all existing and future bucket policies and ACLs, effectively making it impossible to grant public read/write access. AWS Config complements this by continuously evaluating bucket configurations against rules like s3-bucket-public-read-prohibited and s3-bucket-level-public-access-prohibited, alerting on any violation that would allow public access. This combination of preventive control and detective monitoring is the industry-standard guardrail and directly addresses the risk of public exposure from misconfigured policies.
- ✗
Enable S3 versioning on all buckets
Why it's wrong here
Versioning preserves multiple versions of each object, enabling rollback after accidental overwrites or deletions, but it has no effect on how permissions are evaluated. S3 authorization still relies on bucket policies, ACLs, and IAM—versioning does not introduce any additional restrictions. In fact, if a bucket policy permits public read access, versioning can make the problem worse by exposing every historical version of an object, not just the latest one.
- ✗
Enable S3 Transfer Acceleration for all buckets
Why it's wrong here
S3 Transfer Acceleration uses AWS edge locations to route uploads over an optimized network path to the destination bucket, improving transfer speed for geographically dispersed clients. It only alters the data plane transport; it does not change any authorization logic in S3. A bucket with a permissive policy remains publicly accessible on the Internet regardless of whether Transfer Acceleration is enabled, because the acceleration endpoint still evaluates the same bucket policy and IAM permissions for every request.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.