The answer is to notify affected customers. After containment of a misconfigured S3 bucket that exposed customer data, notification is the most critical next step because it fulfills both ethical obligations and legal mandates under frameworks like GDPR and HIPAA, which require timely disclosure of breaches to impacted individuals. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of the incident response lifecycle, specifically the post-containment phase where communication and legal compliance take priority over technical fixes. A common trap is assuming the job is done once the bucket is secured, but regulators and best practices demand that you address the exposure’s impact on data subjects. Remember the memory tip: “Contain, then Complain”—secure the vulnerability first, then notify those affected to avoid penalties and preserve trust.
ISC2 CC Business Continuity, DR & Incident Response Practice Question
This CC practice question tests your understanding of business continuity, dr & incident response. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
In a cloud environment, the security team discovers that a misconfigured S3 bucket has made customer data publicly accessible. After securing the bucket, what is the most important next step?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Notify affected customers
Option C is correct because after securing a misconfigured S3 bucket that exposed customer data, the most important next step is to notify affected customers. This aligns with incident response best practices and regulatory requirements (e.g., GDPR, HIPAA) that mandate timely disclosure of data breaches to impacted individuals. Without notification, the organization may face legal penalties and loss of trust, even if the data is now secure.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Delete the data
Why it's wrong here
Deleting data may destroy forensic evidence and is not the immediate priority.
✗
Review logs to determine access
Why it's wrong here
While important, notification is more urgent; log review can follow.
✓
Notify affected customers
Why this is correct
Breach notification is legally required in many jurisdictions and prioritizes customer protection.
Related concept
Read the scenario before looking for a memorised answer.
✗
Change the bucket policy
Why it's wrong here
The bucket has already been secured; changing policy again is unnecessary.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the misconception that technical remediation (e.g., changing policies or deleting data) is the most important step, when in fact incident response frameworks prioritize communication and legal/regulatory obligations over purely technical actions.
Detailed technical explanation
How to think about this question
Under the hood, AWS S3 bucket policies are evaluated at the resource level, and misconfigurations often involve granting public access via a bucket policy with a `Principal: "*"` statement or an ACL allowing `READ` access to `AllUsers`. In a real-world scenario, after securing the bucket, the security team must also enable AWS CloudTrail and S3 server access logging to reconstruct the exposure timeline, but notification remains the immediate priority to meet regulatory timelines (e.g., 72 hours under GDPR).
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Business Continuity, DR & Incident Response — This question tests Business Continuity, DR & Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Notify affected customers — Option C is correct because after securing a misconfigured S3 bucket that exposed customer data, the most important next step is to notify affected customers. This aligns with incident response best practices and regulatory requirements (e.g., GDPR, HIPAA) that mandate timely disclosure of data breaches to impacted individuals. Without notification, the organization may face legal penalties and loss of trust, even if the data is now secure.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.