CLF-C02 Security and Compliance Practice Question
A security audit found that an S3 bucket is publicly readable. Which IAM/S3 mechanism should be reviewed to identify what grants the public access?
⚠ Common exam trap
A common mix-up: candidates confuse IAM identity-based policies (which control user permissions) with resource-based policies (like bucket policies) that directly grant public access, leading them to incorrectly select Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bucket policies and S3 Block Public Access settings
Bucket policies are resource-based policies that explicitly define who has access to an S3 bucket, including public access grants like `"Principal": "*"`. S3 Block Public Access settings act as an overarching security control that can override bucket policies to prevent public access. Reviewing both mechanisms together identifies exactly how public readability was granted and whether any block was misconfigured or absent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM identity-based policies attached to the root user
Why it's wrong here
IAM identity-based policies are attached to authenticated principals like users, groups, or roles, and they specify what those principals can do—they never grant permissions to unauthenticated users. Because the root user is always an authenticated identity, a policy attached to it only applies to that specific account owner, not to anonymous principals. Public S3 access requires an unauthenticated principal via a bucket policy with '*' or an open ACL; IAM policies attached to the root user simply cannot create that kind of anonymous permission.
- ✓
Bucket policies and S3 Block Public Access settings
Why this is correct
Public S3 access is granted through resource-based policies—specifically bucket policies that set the Principal to the wildcard '*'—or through bucket and object ACLs that permit public read/write. S3 Block Public Access settings act as an additional safeguard that can override and deny these public grants even if a bucket policy or ACL explicitly allows them. Together, these two mechanisms are the direct controls that determine whether an S3 bucket is publicly accessible.
- ✗
AWS Organizations Service Control Policies
Why it's wrong here
AWS Organizations Service Control Policies (SCPs) are account-level permission boundaries that only restrict which actions principals in member accounts can perform; they cannot grant permissions to anyone, including anonymous users. Since public S3 access requires granting the 'Principal': '*' permission in a bucket policy or ACL, an SCP—which is solely a deny-by-default mechanism—has no way to create such a grant. SCPs can block S3 actions, but they are structurally incapable of making a bucket public.
- ✗
Amazon Macie classification rules
Why it's wrong here
Amazon Macie is a data security and privacy service that uses machine learning to discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in S3. It does not provide any access control functionality and cannot modify bucket policies, ACLs, or Block Public Access settings. Macie only generates findings and alerts about data exposure risks; it has no permission to change resource-based policies, so it cannot grant or revoke public access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.