easyMultiple ChoiceObjective-mapped
CCSP Practice Question: During a cloud security audit, it is discovered…
During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?
⚠ Common exam trap
ISC2 often tests the distinction between access control and other security controls, trapping candidates who confuse encryption or logging with network-level access restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the bucket policy to deny access from all IP addresses except trusted ranges.
The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the bucket policy to deny access from all IP addresses except trusted ranges.
Why this is correct
This directly removes public access and restricts to trusted IPs.
- ✗
Enable bucket logging to track access attempts.
Why it's wrong here
Logging only provides visibility, not protection.
- ✗
Notify the security team and wait for a formal change request.
Why it's wrong here
Immediate action is required to mitigate the risk.
- ✗
Enable server-side encryption on the bucket.
Why it's wrong here
Encryption does not prevent unauthorized access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.