easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Protect sensitive data stored in a public cloud…
A company wants to protect sensitive data stored in a public cloud bucket. Which of the following is the MOST effective control to prevent accidental public exposure?
⚠ Common exam trap
Many candidates confuse encryption (Option C) with access control, mistakenly thinking encrypting data prevents unauthorized reading, but encryption only protects the data's confidentiality if the key is managed separately—it does not block public read requests to the bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply resource-based policies with explicit deny for public access
Resource-based policies with an explicit deny for public access are the most effective control because they override any allow statements that might inadvertently grant public access. In cloud providers like AWS, an explicit deny in a bucket policy takes precedence over all other permissions, ensuring that even if other settings (like ACLs) allow public access, the deny blocks it. This directly prevents accidental exposure by enforcing a strict boundary on who can access the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable bucket logging
Why it's wrong here
Logging is detective, not preventive.
- ✗
Implement lifecycle policies
Why it's wrong here
Lifecycle policies manage data retention, not access control.
- ✗
Use server-side encryption
Why it's wrong here
Encryption protects data but does not prevent public access.
- ✓
Apply resource-based policies with explicit deny for public access
Why this is correct
Explicit deny prevents any public access, even if other permissions accidentally allow it.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.