A company is using Amazon S3 to set up a temporary static website that is public. A SysOps administrator creates an S3 bucket by using the default settings. The SysOps administrator updates the S3 buc

Question

Options

• ACreate an Amazon Route 53 DNS entry Point the entry to the S3 bucket.
• BEdit the S3 bucket permissions by turning off Block Public Access settings. Create a bucket policy
• CEdit the permissions on the index html and error html files for read access.
• DEdit the S3 bucket permissions by turning off Block Public Access settings. Create a bucket policy

• A
  5% (2)
• B
  70% (31)
• C
  16% (7)
• D
  9% (4)

Explanation

Option B is correct because S3 buckets created with default settings have Block Public Access enabled, which prevents any public access regardless of other settings. To host a public static website, the administrator must first disable Block Public Access, then attach a bucket policy explicitly granting s3:GetObject to Principal: "*" - both steps are required, and neither alone is sufficient.

Option A is wrong because Route 53 DNS records control domain name routing, not access permissions; adding a DNS entry does nothing to fix a 403 authorization error.

Option C is wrong because object-level ACLs (file permissions) are overridden by Block Public Access when it is enabled - even if you grant read access on individual objects, Block Public Access will still deny them; also, AWS has largely deprecated ACL-based access in favor of bucket policies.

Option D appears identical to B in this question (likely a typo/duplicate in the exam copy), so B is the intended correct choice.

Memory tip: Think of public S3 access as a two-lock door - Block Public Access is the deadbolt (must be unlocked first), and the bucket policy is the door handle (must also be turned). Forgetting either one keeps you locked out with a 403.

No community discussion yet for this question.