DVA-C02 Troubleshooting and Optimization Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The bucket does not have server access logging enabled.

  Why it's wrong here

  Server access logging for an S3 bucket records detailed information about requests made to the bucket, such as the requester, the S3 operation performed, and the time and date of the request. While invaluable for auditing, security analysis, and understanding usage patterns, this logging mechanism is purely a monitoring feature. It does not influence or control the actual permissions or accessibility of the objects within the bucket, meaning its enablement or disablement would not prevent a static website from being publicly accessible if other settings permit it.

• ✗

  The bucket ACL does not allow public read.

  Why it's wrong here

  Amazon S3 provides multiple mechanisms for controlling access to buckets and objects, including Access Control Lists (ACLs) and bucket policies. For static website hosting, a bucket policy that explicitly grants `s3:GetObject` permission to `Principal: *` (representing everyone) is typically the primary and sufficient method to allow public read access. If such a permissive bucket policy is correctly configured and attached, the absence of a public read ACL on the bucket or its individual objects would not prevent public access to the static website content.

• ✗

  The bucket policy is not attached to the correct bucket.

  Why it's wrong here

  For a static website hosted on S3, a bucket policy is fundamental for granting public read access to the website's content. The problem statement implies the developer is working with an S3 bucket *used* for static website hosting, suggesting the correct bucket is already in scope. If a bucket policy is the issue, it's more likely due to incorrect permissions within the policy itself, or an overriding security setting, rather than the policy being entirely misattached to an unrelated or non-existent bucket. Policy attachment is a prerequisite for its evaluation.

• ✓

  The S3 Block Public Access settings are enabled.

  Why this is correct

  Amazon S3 Block Public Access settings provide a crucial security control designed to prevent unintended public exposure of S3 buckets and objects. These settings, configurable at both the account and bucket level, explicitly override all other access control mechanisms, including permissive bucket policies and object ACLs, that would otherwise grant public access. If these Block Public Access settings are enabled, they will effectively block all public access to the static website, regardless of any correctly configured bucket policies or ACLs intended to allow public reads.

Go deeper

Related to this question