A security administrator is setting up a new AWS account. The security administrator wants to secure the data that a company stores in an Amazon S3 bucket. The security administrator also wants to…

Question

Options

• AConfigure the S3 Block Public Access feature for the AWS account.
• BConfigure the S3 Block Public Access feature for all objects that are in the bucket.
• CDeactivate ACLs for objects that are in the bucket.
• DUse AWS PrivateLink for Amazon S3 to access the bucket.

• A
  90% (18)
• B
  5% (1)
• D
  5% (1)

Explanation

Explanation

Configuring S3 Block Public Access at the AWS account level (Option A) is the most efficient solution because it applies a single, blanket control that prevents public access across all current and future S3 buckets in the account, requiring zero ongoing maintenance as new buckets are created. Option B is incorrect because configuring Block Public Access at the individual bucket level creates significant operational overhead - you must remember to apply it to every new bucket manually. Option C (deactivating ACLs) is a valid security practice but only addresses one aspect of access control and doesn't fully protect against misconfiguration or unintended public exposure. Option D (AWS PrivateLink) controls how the bucket is accessed via private networking, but doesn't prevent public exposure of objects themselves and adds infrastructure complexity.

Memory Tip: Think "Account-level = Account-wide protection." When a question asks for least operational overhead with S3 security, always prefer account-level settings over bucket-level or object-level settings - one setting protects everything, now and in the future.

No community discussion yet for this question.