A city classifies datasets as Public, Internal, or Confidential and must map that classification to S3 buckets, encryption, and access controls. Which design best uses classification to drive data security controls?
Select an answer to reveal the explanation.
Short Explanation
Classification is the city’s sorting hat: Public flyers, Internal memos, and Confidential case files should not share one unlocked drawer. Different buckets or prefixes, keys, and policies make the label actually mean something.
Full Explanation
When a city classifies datasets as Public, Internal, or Confidential, classification must drive concrete controls: separate buckets or tightly governed prefixes per class, matching KMS keys or encryption settings, bucket policies, Block Public Access postures, and IAM access patterns so Confidential case files receive stricter encryption and least-privilege access than Public brochures. Labels without isolation invite accidental cross-grants; separate control planes make "Confidential" enforceable rather than decorative.
Storing Public, Internal, and Confidential objects in one world-writable bucket with identical policies fails isolation—one misconfigured grant exposes everything. Publishing Confidential case files to an anonymous CloudFront distribution labeled public-demo fails confidentiality by design. Disabling encryption for Confidential data "for analytics speed" while encrypting only Public brochures inverts risk priorities and fails the classification-driven security goal.
Exam caveat: prefixes can work with careful IAM conditions, but many municipalities prefer separate buckets for Confidential data to simplify public-access blocks and key policies; choose based on operational clarity, not convenience alone. Operational check: attempt anonymous GetObject on Confidential resources (must fail), verify Public thumbnails remain readable if intended, confirm Confidential uses the stronger CMK and roles, and review Macie or Access Analyzer findings for unexpected public exposure.