312-50 Question 441
Single answer▪ Cloud Computing ThreatsA company migrates a customer-facing application to a public cloud platform. During a security assessment, an ethical hacker discovers that a storage bucket used by the application is publicly accessible and contains database export files with customer records. The development team states that the bucket was made public only to simplify content delivery during testing. Which action would MOST directly reduce the risk of this cloud-specific data exposure while preserving legitimate access patterns?
- A
Move the database export files to an encrypted archive inside the same public bucket and share the password with developers
- B
Disable public access to the bucket and grant access through least-privilege IAM roles or pre-signed/object-specific access mechanisms
- C
Keep the bucket public, but enable server-side logging so unauthorized downloads can be investigated later
- D
Place the bucket behind a NAT gateway so only outbound traffic is allowed from the cloud environment
Show answer and explanation
Correct answer: B
Explanation
This scenario tests recognition of one of the most common cloud computing threats: data exposure caused by misconfigured cloud storage. In public cloud environments, object storage services are frequently exposed due to overly permissive bucket policies, ACLs, or account-level public access settings. The most effective response is to remove public access and enforce least-privilege access through IAM-based controls. If external sharing is necessary, use narrowly scoped mechanisms such as pre-signed URLs or equivalent temporary access methods instead of broad anonymous read permissions. This aligns with cloud security best practices from major providers and guidance from organizations such as the Cloud Security Alliance and NIST, which emphasize secure configuration, least privilege, and strong access governance as key mitigations for cloud data leakage.
- A. Incorrect.
This is incorrect. Encrypting files in a public bucket adds a layer of protection, but it does not address the primary cloud threat: misconfigured public exposure. Password sharing also creates weak key-management practices and increases insider and leakage risk. In a real environment, relying on ad hoc password distribution is not an appropriate substitute for access control.
- B. Correct.
This is correct. Publicly accessible cloud storage is a common cloud computing threat caused by misconfiguration. The most direct mitigation is to remove unnecessary public access and enforce least-privilege authorization using identity and access management (IAM) controls. Where temporary external access is required, object-specific mechanisms such as pre-signed URLs can preserve functionality without exposing the entire bucket.
- C. Incorrect.
This is incorrect. Logging is useful for detection, monitoring, and forensics, but it does not prevent unauthorized access. Leaving the bucket public means the exposure remains active. This option reflects a common misconception that visibility alone is an adequate control for cloud data exposure.
- D. Incorrect.
This is incorrect. A NAT gateway controls outbound network translation for resources in private networks; it does not secure a publicly exposed object storage bucket. Cloud object storage access is typically governed by bucket policies, ACLs, and IAM controls rather than by placing the bucket behind NAT. This option confuses network egress design with storage access control.