SCS-C02 Threat Detection and Incident Response Practice Question

Exhibit

Refer to the exhibit.

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-secure-bucket
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketPolicy:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: s3:GetObject
            Resource: !Sub "${MyBucket.Arn}/*"

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

⚠ Common exam trap

The trap is that candidates assume any PublicAccessBlock setting prevents public access, but BlockPublicPolicy specifically blocks bucket policies. Without it, a bucket policy granting public access can be applied, making the bucket public despite other PublicAccessBlock settings.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.

The PublicAccessBlock configuration in the template is missing the BlockPublicPolicy setting. Without BlockPublicPolicy enabled, a bucket policy that grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject) can be applied to the bucket, overriding the intended private configuration. The other PublicAccessBlock settings (BlockPublicAcls, IgnorePublicAcls, RestrictPublicBuckets) do not block bucket policies; only BlockPublicPolicy does. The security issue is that the bucket policy, though present, would be blocked if BlockPublicPolicy were enabled, but since it is missing, the bucket becomes publicly accessible.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.
Why this is correct
The PublicAccessBlock configuration is missing the BlockPublicPolicy setting, so S3 does not reject the bucket policy that explicitly grants public read access. When BlockPublicPolicy is not enabled, a bucket policy allowing public access is evaluated as valid and takes effect, making the bucket publicly readable. Enabling BlockPublicPolicy would cause S3 to deny the policy request and preserve the bucket's private access, thereby eliminating the public exposure.
✗
The bucket does not have versioning enabled.
Why it's wrong here
Bucket versioning is a data-protection feature that retains previous object versions, but it has no influence on access control decisions. Even if versioning were enabled, the bucket would still be publicly accessible because the bucket policy grants public read access and BlockPublicPolicy is not configured to block that policy. The security issue here is specifically the unblocked public policy, not the lack of versioning.
✗
The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.
Why it's wrong here
Incorrect. The bucket policy does grant public read access, but the statement that it overrides PublicAccessBlock is false. In S3, PublicAccessBlock settings are evaluated first and can block public policies if BlockPublicPolicy is enabled. The issue is that BlockPublicPolicy is missing, allowing the policy to take effect.
✗
The bucket policy uses an incorrect resource ARN.
Why it's wrong here
An incorrect resource ARN in the bucket policy would either trigger a policy validation error or inadvertently attach the policy to a different bucket, yet in this scenario the policy is successfully applied to the target bucket. The real misconfiguration is the absence of BlockPublicPolicy, which permits any public bucket policy to be accepted and enforced. Correcting the ARN alone would not resolve the public exposure; you must enable BlockPublicPolicy to prevent such policies from becoming effective.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question