DVA-C02 Troubleshooting and Optimization Practice Question
A developer notices that an S3 bucket policy allows public read access to all objects. The bucket contains sensitive data that should only be accessible by authorized IAM users. What is the BEST way to remediate this?
⚠ Common exam trap
It's easy for candidates to confuse encryption with access control, thinking that enabling encryption (Option A) will prevent unauthorized access, when in fact encryption only protects data at rest and does not affect public read permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the bucket policy to remove the public statement and use IAM policies for access.
The bucket policy currently grants public read access, which overrides any IAM-based restrictions. By removing the public statement from the bucket policy and relying solely on IAM policies, access is controlled at the user level, ensuring only authorized IAM users can read objects. This aligns with the principle of least privilege and follows AWS best practices for securing S3 data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable default encryption on the bucket.
Why it's wrong here
Enabling default encryption on an S3 bucket, such as with SSE-S3 or SSE-KMS, protects data at rest by encrypting objects as they are uploaded. However, encryption is a data protection mechanism for confidentiality, not an access control mechanism. If a bucket policy explicitly grants public read access, S3 will decrypt and serve the objects to any requester, regardless of their encryption status, because the access decision is made *before* decryption.
- ✓
Modify the bucket policy to remove the public statement and use IAM policies for access.
Why this is correct
The most direct and secure solution is to modify the S3 bucket policy to remove any statements that grant public access, typically identified by "Principal: "*". Concurrently, implement specific IAM policies attached to users, groups, or roles to grant precise, least-privilege access to authorized principals. This approach directly addresses the misconfiguration, ensures granular control, and aligns with AWS security best practices for managing access to S3 resources.
- ✗
Enable S3 Block Public Access at the account level.
Why it's wrong here
While enabling S3 Block Public Access (BPA) at the account level would effectively prevent public access to the bucket, it acts as an override or safeguard rather than fixing the underlying misconfigured bucket policy. The public statement would still exist within the bucket policy, creating a potential future vulnerability if BPA were ever disabled. Furthermore, an account-level setting might inadvertently block legitimate public access for other S3 buckets within the account that are intentionally configured for public use, such as static website hosting.
- ✗
Enable S3 Object Ownership and use ACLs.
Why it's wrong here
Enabling S3 Object Ownership with the "Bucket owner enforced" setting actually *disables* ACLs for access control, making bucket policies and IAM policies the sole mechanisms. Even if ACLs were still active, relying on them is generally not recommended by AWS. IAM policies offer a more robust, centralized, and fine-grained approach to managing permissions across all AWS resources, making ACLs a legacy access control method that should be avoided in favor of IAM for modern S3 access management.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.