Bucket configuration needs separate decisions for encryption, website behavior, and access. A KMS encryption setting chooses the default for future stored objects; it doesn't by itself grant reads or change every historical object. A website index setting selects a document name; it doesn't create that document, grant anonymous access, or supply HTTPS.
A presigned request is a bounded delegation from a signing identity. In this simulator, the URL is a local example with an invalid demonstration hostname and no real credential. You can still inspect its target and requested expiration. The final exercise repairs a bucket policy and enables public-access safeguards while preserving an approved reader. This is the edge case: removing public access should not accidentally remove the legitimate business path, and encryption should never be used as a substitute for that authorization check.