easyMultiple Choice
CCSP Practice Question: A small business recently migrated its file…
A small business recently migrated its file server to a cloud storage service like Amazon S3. They use bucket policies to control access. The IT manager, who is not a security expert, configured the bucket policy to allow all users within the company's AWS account to have read and write access. During an internal audit, it was discovered that the bucket also had a public ACL that allowed 'Everyone' to read objects. The security analyst needs to fix the misconfiguration and prevent future occurrences. Which of the following actions should the analyst take first?
⚠ Common exam trap
ISC2 often tests the misconception that deleting and recreating a resource is the safest or quickest fix, when in reality the proper remediation is to modify the existing access controls without destroying the resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the public ACL and update the bucket policy to enforce least privilege.
The immediate priority is to remediate the active vulnerability by removing the public ACL that grants 'Everyone' read access, then updating the bucket policy to enforce least privilege for the company's AWS account. This directly addresses the misconfiguration and aligns with the principle of denying public access by default, which is a core security best practice for cloud storage services like Amazon S3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the bucket and recreate it with default private settings.
Why it's wrong here
Deleting and recreating the bucket removes the public ACL but destroys object data, versioning history and any dependent configurations, and does not by itself prevent recurrence. Recreating with private defaults suits provisioning a new bucket, not remediating an existing one holding live files.
- ✗
Set up a notification to alert when bucket policies change.
Why it's wrong here
Alerting on bucket policy changes detects future drift but leaves the existing public ACL granting Everyone read access in place. Change notification is the right control once the exposure is remediated and preventive guardrails are in place, not as the immediate first action.
- ✓
Remove the public ACL and update the bucket policy to enforce least privilege.
Why this is correct
Removing the public ACL immediately closes the anonymous read exposure, satisfying the audit's urgent remediation requirement. Updating the bucket policy to least privilege then addresses the over-broad account-wide read/write grant, since S3 evaluates ACLs and bucket policies independently — both must be corrected to eliminate unintended access.
- ✗
Enable bucket versioning to recover from accidental public exposure.
Why it's wrong here
Bucket versioning preserves object versions for recovery but does not revoke the public ACL that currently exposes objects to Everyone. Versioning is appropriate for durability and accidental-deletion recovery, not for closing an active public-read misconfiguration that must be removed first.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.