DVA-C02 Security Practice Question
A company wants to ensure that no Amazon S3 buckets in the AWS account can be made publicly accessible, even if a bucket policy or ACL is later configured to allow public access. Which AWS feature should the developer enable to enforce this at the account level?
⚠ Common exam trap
Many exam-takers choose a bucket policy with a Deny clause (Option D) thinking it can enforce account-wide restrictions, but they overlook that such policies are bucket-specific and can be removed or modified by users with appropriate IAM permissions, whereas S3 Block Public Access provides a centralized, immutable account-level control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 Block Public Access
S3 Block Public Access is the correct choice because it provides account-level settings that override any bucket-level policies or ACLs that would grant public access. When enabled at the account level, these settings apply to all current and future S3 buckets, effectively preventing any bucket from becoming publicly accessible regardless of subsequent configuration changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S3 Block Public Access
Why this is correct
S3 Block Public Access, when configured at the account level, provides a comprehensive safeguard against unintended public exposure of S3 buckets and objects. It enforces four distinct settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) that collectively override any bucket policies, ACLs, or object configurations that might otherwise grant public access. This powerful feature ensures that no S3 bucket within the AWS account can be made public, regardless of individual bucket settings.
- ✗
S3 Object Lock
Why it's wrong here
S3 Object Lock is a feature designed to implement a Write Once Read Many (WORM) model for objects, preventing them from being deleted or overwritten for a fixed retention period or indefinitely. Its primary purpose is data immutability and compliance, safeguarding against accidental or malicious modification or deletion of data. This functionality is entirely unrelated to controlling public access permissions for S3 buckets or their contents.
- ✗
S3 Transfer Acceleration
Why it's wrong here
S3 Transfer Acceleration is a performance-enhancing feature that utilizes Amazon CloudFront's globally distributed edge locations to speed up data transfers to and from S3 buckets over long distances. By routing data through these optimized endpoints, it significantly reduces latency for uploads and downloads. This service is solely focused on improving data transfer efficiency and has no capabilities or relevance concerning S3 bucket public access controls or security policies.
- ✗
S3 Bucket Policy with Deny clause
Why it's wrong here
While an S3 bucket policy can be used to deny specific public access, it operates at the individual bucket level and is not an account-wide enforcement mechanism. A bucket policy can be easily misconfigured, overridden by other access methods like ACLs, or simply not applied to every new or existing bucket in the account. Therefore, relying solely on bucket policies does not provide the guaranteed, comprehensive prevention of public access across all S3 buckets within an entire AWS account.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.