The correct actions are to enable S3 Block Public Access settings on the bucket and to apply a Service Control Policy (SCP) that denies the s3:PutBucketPolicy action. S3 Block Public Access acts as a direct, account-level or bucket-level override that prevents any public access configurations, regardless of individual bucket policies or ACLs. An SCP, when applied at the AWS Organizations level, serves as a preventive guardrail that blocks any IAM principal from attaching a public bucket policy, even if they have full administrative permissions. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this pairing tests your understanding of defense-in-depth for S3 security, often appearing in scenarios where a user has full IAM permissions but must still be prevented from making a bucket public. A common trap is assuming IAM permissions alone can override SCPs or Block Public Access—they cannot, as SCPs and Block Public Access are explicit denies that take precedence. Memory tip: think of SCP as the “organizational firewall” and Block Public Access as the “bucket-level kill switch.”
DOP-C02 Security and Compliance Practice Question
This DOP-C02 practice question tests your understanding of security and compliance. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO actions can be taken to protect an S3 bucket from being publicly accessible? (Select TWO.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP to deny s3:PutBucketPolicy.
Option A is correct because an SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use an SCP to deny s3:PutBucketPolicy.
Why this is correct
Prevents users from setting a public bucket policy.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable default encryption on the bucket.
Why it's wrong here
Encryption does not affect public access.
✓
Enable S3 Block Public Access settings on the bucket.
Why this is correct
Directly blocks public access.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable MFA Delete on the bucket.
Why it's wrong here
Protects against deletion, not public access.
✗
Use CloudFront to serve the bucket content.
Why it's wrong here
Does not prevent public access to the bucket.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse security features like encryption or MFA Delete with access control mechanisms, failing to recognize that only explicit policy restrictions (SCP or Block Public Access) can prevent public accessibility.
Detailed technical explanation
How to think about this question
S3 Block Public Access settings (Option C) provide four distinct controls that override bucket policies and ACLs to block public access at the bucket or account level. These settings are evaluated before any policy or ACL, and they can be applied via the AWS Console, CLI, or SCP to enforce organization-wide compliance. Under the hood, S3 evaluates Block Public Access settings first; if any setting is enabled, S3 rejects requests that would grant public access, even if a bucket policy explicitly allows it.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security and Compliance — This question tests Security and Compliance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use an SCP to deny s3:PutBucketPolicy. — Option A is correct because an SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.
What should I do if I get this DOP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions should a DevOps engineer take to prevent an S3 bucket from being publicly accessible? (Choose two.)
medium
A.Enable S3 Versioning on the bucket.
✓ B.Enable S3 Block Public Access at the bucket level.
C.Enable S3 Server Access Logging.
✓ D.Configure a bucket policy that explicitly denies anonymous access.
E.Configure a lifecycle policy to delete objects.
Why B: Option B is correct because enabling S3 Block Public Access at the bucket level provides a centralized, override-proof mechanism to prevent any public access to the bucket, regardless of other policies or ACLs. This setting blocks all public access by default, including access granted via bucket policies, access control lists (ACLs), or object-level permissions, and cannot be overridden by any other S3 configuration.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.