CLF-C02 Practice Question 74: Block Public Access
AWS Certified Cloud Practitioner (CLF-C02) · Test 8 · question 4 of 10
A company has hundreds of Amazon S3 buckets in one AWS account. The security team is worried that a developer could accidentally make a bucket public by editing a bucket policy or an access control list (ACL). It wants one account-wide setting that overrides any policy or ACL granting public access, including for buckets created in the future. What should the team do?
Show answer and explanation
Answer:
S3 Block Public Access provides settings that override bucket policies, access point policies and object permissions that would otherwise allow public access. It can be applied at the organization, account, bucket or access point level. Applied at the account level, it covers all current and future buckets and access points owned by the account. AWS recommends turning on all four settings for the account unless a use case, such as a public static website, genuinely needs public access.
Option A protects data *at rest*, but an encrypted object in a public bucket can still be read by anyone, because S3 decrypts it for authorized requests. (New objects are already encrypted with SSE-S3 by default.) Option B keeps previous versions of objects so they can be recovered. It has no effect on who can access them. Option C discovers sensitive data and reports on it, but it does not prevent a bucket from being made public.