SCS-C02 Management and Security Governance Practice Question

Exhibit

Refer to the exhibit.

[CloudTrail event snippet]
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "Root",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012"
  },
  "eventTime": "2024-03-15T12:34:56Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "PutBucketPolicy",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "[S3Console/1.0]",
  "requestParameters": {
    "bucketName": "my-critical-bucket",
    "bucketPolicy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::my-critical-bucket/*"
        }
      ]
    }
  },
  "responseElements": null
}

A security engineer reviews the above CloudTrail event. Which action should the engineer take FIRST to mitigate a potential security issue?

⚠ Common exam trap

The trap here is that candidates may focus on disabling the root user's access keys (Option D) because they associate root user actions with compromised credentials, but the real issue is the bucket policy itself—the root user intentionally or unintentionally made the bucket public, and the immediate fix is to revert that policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Revert the bucket policy to remove the public access.

The CloudTrail event shows that the root user executed `s3:PutBucketPolicy` to apply a bucket policy that grants public access (e.g., `Principal: "*"` or `Effect: "Allow"` with `Action: "s3:GetObject"`). Reverting the bucket policy to remove public access is the immediate corrective action to stop unauthorized data exposure. This directly addresses the security issue by revoking the public read permissions that were just granted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Revert the bucket policy to remove the public access.
Why this is correct
Reverting the bucket policy is the correct immediate action because the CloudTrail event shows a PutBucketPolicy call that assigned public read access (e.g., Principal * and s3:GetObject). The bucket is now publicly readable, so you must restore the previous policy version or edit the policy to remove the public grant. While you should also check S3 Block Public Access settings and audit IAM permissions, undoing the policy change is the direct way to stop the exposure.
✗
Delete the bucket to prevent data exposure.
Why it's wrong here
Deleting the bucket is an unjustified, destructive step that would permanently delete all objects, which may be unrecoverable without versioning or replication. It also fails to fix the underlying misconfiguration, as the same human or process could repeat the mistake on another bucket. Moreover, applications and S3 event notifications that reference the bucket would break, causing a wider outage. Therefore, deletion is not an appropriate first-line remediation.
✗
Contact the root user to confirm the action.
Why it's wrong here
Contacting the root user for confirmation is not an effective first step because the CloudTrail event already provides the identity of the principal (either the root user or an IAM user/role with elevated permissions) and the timestamp. Waiting for a human response leaves the bucket publicly accessible in the meantime, which is unacceptable for data confidentiality. While it's wise to coordinate with the account owner to determine intent and prevent recurrence, the immediate priority is to revoke the public access.
✗
Disable the root user's access keys.
Why it's wrong here
Disabling root user access keys is a non sequitur here because the event was performed through the AWS Management Console, which does not use access keys, and AWS best practices discourage creating access keys for the root user in the first place. The suspicious change is a bucket policy modification, not an authentication issue, so revoking keys would have no effect on the current public exposure. Removing the access keys would also be an overreaction that could break any infrastructure that legitimately relies on them.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Management and Security Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question