SCS-C02 Question 72
Single answerAn organization detects unauthorized access to an S3 bucket storing sensitive data. As a security engineer, you are tasked with determining the root cause of this incident. Which approach would best help you identify how the unauthorized access occurred?
- A
Review the S3 bucket's access control list (ACL) and bucket policies for overly permissive settings.
- B
Analyze the VPC flow logs to identify traffic patterns to and from the S3 bucket.
- C
Inspect the S3 bucket's versioning settings to check for accidental deletions of objects.
- D
Review the AWS Trusted Advisor recommendations for cost optimization.
Show answer and explanation
Correct answer: A
Explanation
To determine the root cause of unauthorized access to an S3 bucket, the first step is to review its access control list (ACL) and bucket policies. Overly permissive configurations, such as allowing public access or granting everyone 's3:GetObject' permissions, are common causes of such incidents. Understanding these configurations is crucial for identifying and addressing the issue.
- A. Correct.
Reviewing the S3 bucket's access control list (ACL) and bucket policies is critical to identify overly permissive configurations that may have allowed unauthorized access. This is a key step in root cause analysis for S3-related incidents.
- B. Incorrect.
While VPC flow logs can provide useful insights into network traffic patterns, they are not directly helpful in determining access policy misconfigurations or unauthorized access to an S3 bucket.
- C. Incorrect.
Inspecting S3 versioning settings is unrelated to identifying unauthorized access. Versioning is more about data recovery and protection against accidental deletions.
- D. Incorrect.
AWS Trusted Advisor is useful for optimizing resources and improving security, but its cost optimization recommendations are not relevant for root cause analysis of unauthorized S3 bucket access.