easyMultiple Choice
CAS-004 Practice Question: Protect sensitive data stored in a public cloud…
A company wants to protect sensitive data stored in a public cloud bucket. Which of the following is the MOST effective control to prevent accidental public exposure?
⚠ Common exam trap
Many candidates confuse encryption (Option C) with access control, mistakenly thinking encrypting data prevents unauthorized reading, but encryption only protects the data's confidentiality if the key is managed separately—it does not block public read requests to the bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply resource-based policies with explicit deny for public access
Resource-based policies with an explicit deny for public access are the most effective control because they override any allow statements that might inadvertently grant public access. In cloud providers like AWS, an explicit deny in a bucket policy takes precedence over all other permissions, ensuring that even if other settings (like ACLs) allow public access, the deny blocks it. This directly prevents accidental exposure by enforcing a strict boundary on who can access the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable bucket logging
Why it's wrong here
Bucket logging records access requests for audit and forensics after the fact; it neither blocks nor reverts a public ACL. Logging suits detection and investigation, whereas preventing accidental exposure requires enforcing public access prevention or disabling public ACLs on the bucket.
- ✗
Implement lifecycle policies
Why it's wrong here
Lifecycle policies transition or delete objects by age, they do not evaluate bucket ACLs or public access settings. They suit cost and retention management; preventing public exposure requires blocking public ACLs and enforcing public access prevention at the bucket or organisation level.
- ✗
Use server-side encryption
Why it's wrong here
Server-side encryption protects data at rest from unauthorised reading of stored objects, but an object marked public is still downloadable because the bucket policy grants access before decryption. Encryption suits compliance for data at rest, not exposure prevention.
- ✓
Apply resource-based policies with explicit deny for public access
Why this is correct
Resource-based policies with an explicit deny for public access override any bucket or object ACL that would otherwise grant anonymous read, directly preventing accidental exposure. This control enforces the restriction at the resource itself, satisfying the requirement to block public access reliably.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.