DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable versioning.

  Why it's wrong here

  Enabling versioning on an S3 bucket preserves every version of an object, which helps you recover from accidental overwrites or deletions, but it does not restrict who can read the data. Versioning is a data-integrity and availability feature; it does not add any confidentiality or access-control enforcement, so a malicious actor with read permissions can still retrieve all versions and leak data. In fact, if versioning was previously enabled with permissive ACLs, historical versions can remain accessible even after you tighten current object permissions, making it not a leak-prevention control.

• ✓

  Enable default encryption.

  Why this is correct

  Enabling default encryption for an S3 bucket ensures that all newly written objects are encrypted at rest, either with SSE-S3 (AES-256) or SSE-KMS, so the raw data is stored as ciphertext. This protects against data leaks where an attacker gains access to the underlying storage media or backups, because they cannot interpret the encrypted bytes without the decryption keys. Note that default encryption is not a replacement for access control; it is a confidentiality layer that complements IAM policies and Block Public Access, and it can be enforced at the bucket policy level to reject unencrypted writes.

• ✗

  Enable MFA Delete.

  Why it's wrong here

  MFA Delete requires a user to provide a valid MFA code before deleting an object version or changing the bucket's versioning state, which hardens the bucket against unauthorized deletion by a compromised credential. However, MFA Delete only protects the deletion operation; it does not affect read access in any way, so an attacker with S3:GetObject permissions can still download and exfiltrate data. This control is designed to prevent data loss and tampering, not to prevent data leaks, making it incorrect for a question about protecting against unauthorized disclosure.

• ✓

  Block public access at the bucket level.

  Why this is correct

  Blocking public access at the bucket level is a direct and effective guard against data leaks because it overrides any bucket policy with a wildcard Principal `"*"` or an ACL that grants public read permissions, disallowing any anonymous access to the bucket or its objects. The S3 Block Public Access feature provides four settings—BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets—which together ensure that no bucken is inadvertently exposed to the entire internet, a common cause of large-scale S3 data breaches. This is an access-control measure, not an encryption measure, and it is one of the strongest leak-prevention controls available for S3.

• ✗

  Configure cross-region replication.

  Why it's wrong here

  Cross-region replication (CRR) asynchronously copies every object from the source bucket to a destination bucket in a different AWS Region, which is primarily used for geographic redundancy, disaster recovery, latency optimization, or compliance requirements. It does not change the permissions or encryption on either bucket and, in fact, replicates bucket policies and ACLs—so if the source bucket has a misconfigured public policy, that policy is replicated to the destination, potentially doubling your exposure. CRR is a data-availability feature; it neither detects nor prevents unauthorized read access, so it cannot protect an S3 bucket from data leaks.

Go deeper

Related to this question