SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable default encryption → Block public access → Attach bucket policy → Enable versioning → Enable access logging

  Why this is correct

  This order is correct because encryption should be enabled first to protect data at rest, then block public access to prevent unauthorized access, attach a bucket policy to define fine-grained permissions, enable versioning to preserve object versions, and finally enable access logging for auditing.

• ✗

  Block public access → Enable default encryption → Attach bucket policy → Enable versioning → Enable access logging

  Why it's wrong here

  Starting with Block public access before default encryption leaves a window where any objects already in the bucket (or written while you configure policies) are stored in plaintext at rest. Default encryption (e.g., SSE-S3 or SSE-KMS) only encrypts objects created after the setting is enabled, so enabling it second does not retroactively protect existing data. Furthermore, blocking public access is a network-level guardrail, not a data-protection control; it does not substitute for mandatory encryption, which should be applied at the very start of the hardening process.

• ✗

  Enable default encryption → Block public access → Enable versioning → Attach bucket policy → Enable access logging

  Why it's wrong here

  This order is incorrect because enabling versioning before attaching the bucket policy can cause versioned objects to be subject to unintended permissions. The bucket policy should be in place to control access before versioning is enabled.

• ✗

  Enable default encryption → Enable versioning → Block public access → Attach bucket policy → Enable access logging

  Why it's wrong here

  Enabling versioning before Block public access is hazardous because versioning does not restrict access—it preserves every overwritten or deleted object. If the bucket is even briefly public (or misconfigured with an overly permissive ACL), a single object uploaded during that window becomes multiple exposed versions, each readable and potentially containing sensitive data. Block public access must be established first so that no version can be created while the bucket is in a permissive state; only after that baseline should versioning be turned on to support recovery from accidental deletions or corruption.

Go deeper

Related to this question