CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The bucket has versioning enabled

  Why it's wrong here

  AWS S3 versioning is a data management feature designed to preserve multiple versions of an object in the same bucket. It protects against accidental deletions or overwrites by allowing recovery of previous object states. While crucial for data integrity and recovery, versioning does not inherently affect the access control mechanisms of an S3 bucket, nor does it expose data publicly. Therefore, it is not a security misconfiguration in the context of unauthorized public access.

• ✗

  The bucket ACL grants 'FullControl' to 'AuthenticatedUsers' group

  Why it's wrong here

  An S3 Access Control List (ACL) granting 'FullControl' to the 'AuthenticatedUsers' group means that any AWS account that has been authenticated (i.e., possesses valid AWS credentials) can access the bucket. This group specifically excludes anonymous users and requires a legitimate AWS identity. While broad, it does not constitute public access, which would allow *any* user, authenticated or not, to access the bucket without specific AWS credentials.

• ✗

  The bucket is encrypted with SSE-S3

  Why it's wrong here

  Server-Side Encryption with S3-managed keys (SSE-S3) ensures that objects are encrypted at rest within AWS S3 using keys managed by AWS. This protects data confidentiality during storage. However, encryption is a data protection mechanism, not an access control mechanism. It dictates how data is stored, not who is authorized to retrieve it. An encrypted bucket can still be publicly accessible if its access policies permit it, as encryption occurs after access is granted.

• ✓

  The bucket policy uses 'Principal': '*' and 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}}

  Why this is correct

  This bucket policy explicitly grants access to 'Principal': '*', which signifies *any* AWS identity or anonymous user. The accompanying 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}} further specifies that this broad access is permitted from *any* IPv4 address. The combination of allowing any principal from any IP address effectively overrides any other restrictions and renders the S3 bucket completely public and accessible to the entire internet, which is a critical security misconfiguration.

Go deeper

Related to this question