AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 119

Question

A company has AWS accounts that are in an organization in AWS Organizations. An Amazon S3 bucket in one of the accounts is publicly accessible. A security engineer must change the configuration so that the S3 bucket is no longer publicly accessible. The security engineer also must ensure that the S3 bucket cannot be made publicly accessible in the future. Which solution will meet these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Enable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account. Amazon S3 provides durable, scalable object storage that is fully managed. Service Control Policies set guardrails on what accounts in an organization can do. AWS Config tracks resource configuration changes and evaluates compliance.

AWS Certified Security - Specialty SCS-C02 — Question 119