easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A small business recently migrated its file…
A small business recently migrated its file server to a cloud storage service like Amazon S3. They use bucket policies to control access. The IT manager, who is not a security expert, configured the bucket policy to allow all users within the company's AWS account to have read and write access. During an internal audit, it was discovered that the bucket also had a public ACL that allowed 'Everyone' to read objects. The security analyst needs to fix the misconfiguration and prevent future occurrences. Which of the following actions should the analyst take first?
⚠ Common exam trap
ISC2 often tests the misconception that deleting and recreating a resource is the safest or quickest fix, when in reality the proper remediation is to modify the existing access controls without destroying the resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the public ACL and update the bucket policy to enforce least privilege.
The immediate priority is to remediate the active vulnerability by removing the public ACL that grants 'Everyone' read access, then updating the bucket policy to enforce least privilege for the company's AWS account. This directly addresses the misconfiguration and aligns with the principle of denying public access by default, which is a core security best practice for cloud storage services like Amazon S3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the bucket and recreate it with default private settings.
Why it's wrong here
Drastic and may cause downtime; same effect can be achieved with policy changes.
- ✗
Set up a notification to alert when bucket policies change.
Why it's wrong here
Notification is detective, not corrective.
- ✓
Remove the public ACL and update the bucket policy to enforce least privilege.
Why this is correct
Directly fixes the public exposure and tightens access.
- ✗
Enable bucket versioning to recover from accidental public exposure.
Why it's wrong here
Versioning does not prevent or fix public access.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.