mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: The exhibit shows a bucket policy that grants…
Exhibit
Refer to the exhibit.
```
{
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::public-bucket/*"
}
]
}
```
After applying this bucket policy, the owner notices that the bucket is publicly accessible. Which additional configuration must be adjusted to make the bucket private?The exhibit shows a bucket policy that grants public read access. What is the most effective way to remove this public access?
⚠ Common exam trap
ISC2 often tests the misconception that modifying the bucket policy or ACLs is sufficient to remove public access, but the trap is that these can be overridden or misconfigured, whereas public access prevention settings provide a guaranteed, centralized control that cannot be bypassed by other permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable public access prevention at the bucket or account level.
Public access prevention settings provide a definitive, override-capable mechanism to prevent any public access to a cloud storage bucket, regardless of other policies or ACLs. Applied at the bucket or account level, these settings block all public access even if a bucket policy explicitly grants it, making them the most effective and secure method to remove public access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an access control list (ACL) that denies public access.
Why it's wrong here
ACLs are legacy and can be overridden by bucket policies.
- ✗
Change the bucket policy to deny all access.
Why it's wrong here
A deny statement would conflict with the allow; a better approach is to remove the policy entirely.
- ✓
Enable public access prevention at the bucket or account level.
Why this is correct
Block Public Access settings explicitly deny public access, overriding any bucket policies.
- ✗
Enable bucket versioning and delete the public objects.
Why it's wrong here
Deleting objects does not prevent future uploads from being public.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.