CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security team discovers that an S3 bucket configured for static website hosting is exposing sensitive documents. The bucket policy allows public read access. Which AWS misconfiguration is MOST likely present?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy allows s3:GetObject for all principals
Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The bucket policy allows s3:GetObject for all principals
Why this is correct
A bucket policy explicitly allowing the "s3:GetObject" action for "Principal": "*" (all principals) directly grants public read access to all objects within that S3 bucket. This configuration overrides default private settings, making the bucket's contents accessible to anyone on the internet without authentication. Such a policy is the primary mechanism for intentionally exposing S3 objects publicly for read operations.
- ✗
The bucket versioning is disabled
Why it's wrong here
Disabling S3 bucket versioning means that when an object is overwritten or deleted, its previous versions are not retained. While crucial for data recovery and accidental deletion protection, versioning solely pertains to the lifecycle and historical states of objects, not their access permissions. Therefore, whether versioning is enabled or disabled has no bearing on whether the bucket's contents are publicly readable.
- ✗
The bucket is not using server-side encryption
Why it's wrong here
Server-side encryption (SSE) protects data at rest by encrypting objects as they are written to S3 and decrypting them upon retrieval. This security measure safeguards the confidentiality of the data itself, but it does not control who is authorized to access or retrieve those objects. An unencrypted bucket can still be private, and an encrypted bucket can still be public if its access policies permit.
- ✗
The bucket ACL grants write access to authenticated users
Why it's wrong here
An Access Control List (ACL) granting write access to 'authenticated users' permits any AWS account holder to modify or delete objects, provided they are authenticated to AWS. However, 'authenticated users' is a specific AWS identity group, distinct from 'all users' or public access. Furthermore, write access allows modification, but it does not inherently grant read access to the public, which is the core issue of public readability.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.