A company discovers that a sensitive S3 bucket was accidentally made public. They want to guarantee that no bucket or object in their account can ever be made public, regardless of individual bucket policies. What should they do?
A) Add a deny-all statement to every existing bucket policy.
B) Enable S3 Block Public Access at the account level.
C) Encrypt all objects with SSE-KMS.
D) Move all buckets to a private VPC.
Correct Answer: B
Explanation: S3 Block Public Access, enabled at the account level, overrides any bucket-level or object-level ACLs and policies that would grant public access — a single account-wide guardrail. (A) is error-prone and must be repeated per bucket. (C) protects data at rest but doesn’t prevent public access. (D) S3 isn’t placed “inside” a VPC.