DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Block public access at the bucket level

  Why this is correct

  Blocking public access at the bucket level is a key security control that prevents all public access, even if a bucket policy or ACL explicitly grants it. This setting overrides any permissive configuration and acts as a safety net against accidental data leaks, making it a mandatory part of AWS S3 security best practices. By enforcing this at the bucket level, you eliminate the risk of objects being inadvertently exposed to the internet.

• ✗

  Disable versioning to reduce complexity

  Why it's wrong here

  Disabling versioning removes the ability to recover overwritten or deleted objects, as versioning preserves every change and provides an audit trail for rollback. This directly undermines the durability and security posture of your S3 data, because a single accidental delete or malicious action can permanently destroy data. Far from reducing complexity, disabling versioning creates a critical single point of failure, so it is never recommended as a security measure.

• ✗

  Use HTTP instead of HTTPS for faster access

  Why it's wrong here

  Using HTTP instead of HTTPS for S3 transfers transmits data in plaintext, leaving it vulnerable to eavesdropping and man-in-the-middle attacks. AWS S3 servers and API endpoints enforce TLS, so HTTPS is both a technical requirement and a fundamental security necessity for protecting data in transit. There is no meaningful performance gain that justifies the severe exposure of unencrypted communication with your bucket.

• ✓

  Enable default encryption

  Why this is correct

  Enabling default encryption ensures every newly uploaded object is automatically encrypted at rest, even if the upload does not specify an encryption header. This closes the gap created by user oversight and guarantees that all data stored in the bucket meets encryption compliance standards. With options like SSE-S3, SSE-KMS, or SSE-C, default encryption provides flexible key management while ensuring comprehensive protection.

• ✗

  Grant public read access via ACLs

  Why it's wrong here

  Granting public read access via ACLs explicitly allows any anonymous user to retrieve objects, making your bucket's contents visible to the entire internet. ACLs are a legacy access-control mechanism that lacks the centralized control and clarity of modern IAM-based policies, and they are prone to misconfiguration. AWS recommends using S3 Block Public Access and carefully managed bucket policies instead of ACLs to avoid unintended exposure.

Go deeper

Related to this question