GSEC Virtualization, Cloud, and AI Essentials Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable public access and rely on bucket ACLs for granular object permission.

  Why it's wrong here

  Public access should never be enabled for buckets containing sensitive data, as it creates an immediate risk of mass exfiltration. Relying solely on ACLs is an outdated practice that often leads to inconsistent security postures; IAM policies are the preferred method for managing modern cloud permissions.

• ✓

  Restrict access to specific IAM roles and require Secure Transport.

  Why this is correct

  Restricting access to specific IAM roles ensures that only authorized entities can interact with the bucket. Requiring Secure Transport (HTTPS) ensures that data in transit is encrypted, protecting against interception. This combination adheres to the principle of least privilege and robust data protection standards.

• ✗

  Assign full administrative rights to the bucket root user for ease of management.

  Why it's wrong here

  Assigning full administrative rights to any user, especially for routine bucket access, violates the principle of least privilege. This creates excessive risk if credentials are compromised, as the attacker would have full authority to delete data, modify policies, or change encryption settings across the bucket.

• ✗

  Use a wildcard principal in the bucket policy to allow internal cross-account access.

  Why it's wrong here

  Using wildcard principals in IAM policies is dangerous because it grants permissions to unauthorized accounts or identities. Cross-account access should always be explicitly scoped to specific, trusted AWS account IDs to prevent privilege escalation or unauthorized data access by external entities within the cloud environment.