SY0-701 Security Architecture Practice Question
A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?
⚠ Common exam trap
Candidates often confuse encryption at rest with access control, assuming that encryption alone prevents unauthorized access, when in fact it only protects against physical theft of storage media, not against API-level access by users with excessive permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.
Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assume the provider's default settings are sufficient because encryption at rest is already enabled.
Why it's wrong here
Encryption at rest, such as SSE-S3 or AES-256, only protects data when it is stored on disk; it does not validate the identity of a user requesting an object. Providers like AWS often configure new buckets with default settings that inherit the account-level permissions, which may allow any authenticated user in the account to read objects if not explicitly restricted. Assuming the provider's defaults are sufficient ignores the shared responsibility model, where the customer must configure bucket policies, IAM roles, and access control lists to limit who can actually call the GetObject operation.
- ✗
Move the documents to a public bucket so users can access them without friction.
Why it's wrong here
Making a bucket public means any unauthenticated user on the internet can list objects and read customer documents, completely removing any authentication or authorization barrier. Public access is the opposite of least privilege and directly increases the risk of unauthorized disclosure, potentially violating data protection regulations such as GDPR or HIPAA. Even if the goal is convenient access for legitimate users, the correct approach is to use managed access controls like presigned URLs or a CDN with signed requests, not to expose the entire bucket.
- ✓
Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.
Why this is correct
In the shared responsibility model, the customer is responsible for managing access controls on the objects they store, and least privilege ensures each approved user or application receives only the permissions necessary to perform its function. This is accomplished by combining IAM roles that define a principal's allowed actions, bucket policies that restrict who can access the bucket and under what conditions (e.g., source IP or MFA), and object permissions like ACLs or condition keys that scope access to specific objects. Configuring these elements for approved users only minimizes the attack surface and helps meet compliance requirements by preventing unauthorized GetObject calls.
- ✗
Disable encryption at rest so administrators can troubleshoot access problems more easily.
Why it's wrong here
Disabling encryption at rest directly compromises data confidentiality by storing customer documents as plaintext, so any physical theft of storage media or misconfigured snapshot would expose the contents. Encryption is a defense-in-depth control that is independent of authentication and authorization; removing it does not clarify or resolve access-control issues because troubleshooting requires inspecting IAM policies, bucket policies, and audit logs, not decrypting files. Furthermore, many security frameworks and regulations mandate encryption at rest, so disabling it would fail security assessments.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.