With the threat of ransomware viruses encrypting and holding company data hostage, which action should be taken to protect an Amazon S3 bucket?

Question

Options

• ADeny Post, Put, and Delete on the bucket.
• BEnable server-side encryption on the bucket.
• CEnable Amazon S3 versioning on the bucket.
• DEnable snapshots on the bucket.

• A
  11% (3)
• B
  4% (1)
• C
  81% (22)
• D
  4% (1)

Explanation

Enabling S3 versioning (C) protects against ransomware by preserving previous versions of objects - if attackers encrypt or overwrite your files, you can restore clean versions from before the attack, making versioning the most direct defense against this specific threat. Denying POST, PUT, and DELETE (A) would break normal bucket operations and prevent legitimate writes, making it impractical for a functioning system. Server-side encryption (B) protects data at rest from unauthorized access, but it doesn't help when ransomware uses your own credentials to overwrite files - the encrypted ransomware payload would just be encrypted at rest too. Snapshots (D) are not a native S3 feature (that concept applies to EBS volumes), so this is a distractor drawing on familiarity with other AWS services.

Memory tip: Think "version = undo button" - versioning lets you roll back to a clean state, which is exactly what ransomware recovery requires.

No community discussion yet for this question.