SOA-C02 Security and Compliance Practice Question

Which TWO actions should a SysOps administrator take to secure an S3 bucket that stores sensitive data? (Choose two.)

⚠ Common exam trap

SOA-C02 often tests the misconception that features like Versioning or Transfer Acceleration improve security, when in fact Block Public Access and access logging are the correct security-focused controls.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 Block Public Access settings on the bucket.

Option A is correct because enabling S3 Block Public Access on the bucket applies the four block-public-access settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) that prevent sensitive objects from ever being exposed through public ACLs or bucket policies. Option D is correct because S3 server access logging records detailed, request-level records (requester, bucket, key, operation, response status, source IP) to a target bucket, giving the audit trail needed to detect and investigate unauthorized access to sensitive data. Option B is not appropriate because CORS only controls which web origins may make cross-origin browser requests to the bucket; it is a browser-enforcement mechanism, not an access-control or data-protection control. Option C is not appropriate because S3 Versioning only preserves multiple object versions to aid recovery from overwrites or deletes; it does not restrict who can read the data. Option E is not appropriate because S3 Transfer Acceleration merely speeds up uploads/downloads via AWS edge locations and provides no security benefit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable S3 Block Public Access settings on the bucket.
Why this is correct
This is a bucket-level and account-level security control that, when applied, overrides any bucket policies or object ACLs that would grant public read/write access, effectively preventing the bucket and its objects from being accessible to the anonymous internet. For a scenario requiring data to be kept private, blocking public access is the direct and definitive remedy, and it also prevents future accidental public exposure through misconfigured policies or ACLs.
✗
Enable cross-origin resource sharing (CORS) on the bucket.
Why it's wrong here
CORS configures how web browsers are allowed to load resources from a different origin. It's about relaxing the same-origin policy for legitimate cross-domain requests, not about restricting access or protecting data from unauthorized users. CORS does not affect whether objects are publicly readable; it only governs HTTP header behavior for browser-based clients.
✗
Enable S3 Versioning.
Why it's wrong here
Versioning keeps multiple variants of an object, letting you recover from accidental deletion or overwrites, but it does not restrict who can read or write objects. It actually adds storage and can complicate lifecycle management; it doesn't block public access or enforce authentication/authorization.
✓
Enable S3 server access logging.
Why this is correct
This records detailed records of all requests made to the bucket—requester, IP, action, response status—into a designated logging bucket. While it doesn't prevent unauthorized access, it provides a forensic audit trail that allows you to detect probing, verify that previous public exposure occurred, and support incident investigation after a breach.
✗
Enable S3 Transfer Acceleration.
Why it's wrong here
This feature uses a global network of edge locations to speed up uploads over long distances by transferring data from the edge to S3 over optimized network paths. It has no impact on access control or data protection; it's purely a performance booster for high-latency or high-bandwidth transfers, and can actually incur additional costs.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question