DVA-C02 Security Practice Question
A security audit reveals that an S3 bucket is publicly accessible. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Which TWO actions should be taken to remediate this issue? (Select TWO.)
⚠ Common exam trap
It's easy for candidates to think only the bucket policy needs fixing, overlooking that ACLs can independently grant public access, so both the policy and ACL must be remediated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the public access grant from the bucket ACL.
The bucket ACL may still grant public access even if the bucket policy is the primary issue. Removing the public access grant from the ACL ensures that no anonymous principals have s3:GetObject permissions via ACLs, which is a separate access control mechanism from bucket policies. This is a direct remediation step to eliminate public read access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the public access grant from the bucket ACL.
Why this is correct
Removing a public access grant from the bucket Access Control List (ACL) is a direct and effective method to revoke public access. ACLs are a legacy access control mechanism that can explicitly grant read or write permissions to predefined groups like "Everyone" (public access) or "Authenticated Users". By deleting the specific ACL entry that allows public read access, the bucket immediately ceases to be publicly accessible via that mechanism.
- ✗
Create an IAM user policy that denies s3:GetObject for anonymous users.
Why it's wrong here
Creating an IAM user policy that denies s3:GetObject for anonymous users is ineffective because IAM user policies are designed to control permissions for specific IAM identities (users, groups, roles). Anonymous users, by definition, do not possess an IAM identity to which such a policy could be attached or applied. To control access for anonymous users, a bucket policy must be used, as it applies directly to the S3 resource itself.
- ✗
Enable versioning on the bucket.
Why it's wrong here
Enabling versioning on an S3 bucket is a data durability feature that preserves multiple versions of an object, protecting against accidental deletions or overwrites. While crucial for data recovery and integrity, versioning has no impact whatsoever on the access control mechanisms governing who can read, write, or delete objects within the bucket. It is entirely separate from permissions management.
- ✓
Modify the bucket policy to remove the Allow effect for Principal "*".
Why this is correct
Modifying the bucket policy to remove an Allow effect for Principal "*" directly revokes public access. A bucket policy statement with Principal "*" explicitly grants permissions to all users, including anonymous users, making the bucket or its objects publicly accessible. Eliminating or restricting such a statement is a fundamental step in securing an S3 bucket against unintended public exposure.
- ✗
Enable default encryption on the bucket.
Why it's wrong here
Enabling default encryption on an S3 bucket ensures that all new objects uploaded are encrypted at rest, enhancing data security and compliance. However, encryption is a data protection measure that scrambles data to prevent unauthorized viewing if storage is compromised; it is not an access control mechanism. An encrypted object can still be publicly accessible if the bucket policy or ACL permits it, as encryption does not restrict who can retrieve the object.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer wants to ensure that an S3 bucket is not publicly accessible. Which TWO measures should the developer implement?
easy- A.Enable S3 server access logging.
- B.Enable versioning on the bucket.
- C.Enable default encryption on the bucket.
- ✓ D.Review the bucket policy to ensure it does not allow public access.
- ✓ E.Enable S3 Block Public Access settings on the bucket.
Why D: Option D is correct because the bucket policy is the resource-based policy that can explicitly grant public access (for example, a Principal of "*" with s3:GetObject), so reviewing it to confirm it does not allow public access is a direct way to prevent the bucket from being publicly accessible. Option E is correct because S3 Block Public Access settings, when enabled on the bucket, override any bucket policy or ACL that would otherwise make objects public, providing a strong account- or bucket-level safeguard against public exposure. Option A is incorrect because S3 server access logging only records requests made to the bucket for auditing purposes; it does not restrict or prevent public access. Option B is incorrect because versioning preserves multiple versions of objects for recovery and rollback, but it has no effect on whether the bucket or its objects are publicly accessible. Option C is incorrect because default encryption protects data at rest but does not control who can access the objects, so it does not prevent public accessibility.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.