mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A cloud posture scan finds a storage bucket with…
A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For validation, Which action should be taken before closing or downgrading the finding?
⚠ Common exam trap
CompTIA often tests the misconception that rotating credentials (Option B) is the primary fix for a misconfiguration, when the actual first step is to remove the public access and investigate exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict public access and determine whether sensitive data was accessed
The immediate priority is to restrict public read access to the storage bucket to prevent further unauthorized exposure, then determine whether sensitive customer data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs). This aligns with incident response best practices: contain the threat first, then assess impact. Without confirming data access, the team cannot properly scope the breach or notify affected parties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wait for the next quarterly review
Why it's wrong here
Waiting for a quarterly review is an unacceptable delay when a storage bucket has public read access. This vulnerability presents an immediate and severe risk of unauthorized data exfiltration, potential data breaches, and significant reputational damage. Prompt action is critical to contain the exposure, mitigate potential harm, and comply with data protection regulations that mandate timely incident response.
- ✗
Rotate database administrator passwords only
Why it's wrong here
Rotating database administrator passwords is an irrelevant action for addressing a publicly accessible storage bucket. This measure focuses on internal database authentication, which is unrelated to the external misconfiguration allowing public read access to the storage object itself. The core issue is the bucket's access policy, not compromised internal credentials, making this an ineffective response to the identified vulnerability.
- ✗
Delete all audit logs to reduce liability
Why it's wrong here
Deleting audit logs is a detrimental action that actively obstructs incident response and forensic analysis efforts. These logs are crucial for determining the scope of the breach, identifying potential attackers, and assessing what data may have been accessed or exfiltrated. Furthermore, destroying logs can violate regulatory compliance requirements and internal policies, potentially increasing legal and financial liabilities rather than reducing them.
- ✓
Restrict public access and determine whether sensitive data was accessed
Why this is correct
The immediate priority is to restrict public access to the storage bucket, effectively containing the data exposure and preventing further unauthorized access. Following containment, it is crucial to conduct a thorough investigation to determine if sensitive data was present in the bucket and whether it was accessed or exfiltrated during the period of public exposure. This two-pronged approach aligns with incident response best practices, focusing on mitigation and subsequent impact assessment.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.