DEA-C01 Data Store Management Practice Question
A company is storing sensitive user data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. The bucket policy must deny any PUT request that does not include the appropriate encryption header. Which bucket policy condition key should be used?
⚠ Common exam trap
It's easy for candidates to confuse `s3:x-amz-server-side-encryption` (which only checks the encryption algorithm, not the key) with `s3:x-amz-server-side-encryption-aws-kms-key-id` (which checks the specific KMS key ID), leading them to pick option B when the requirement explicitly demands a customer-managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption-aws-kms-key-id
The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows the bucket policy to enforce that PUT requests include a specific customer-managed KMS key ID in the `x-amz-server-side-encryption-aws-kms-key-id` header, ensuring encryption at rest with the required key. This directly meets the security team's requirement to deny PUT requests that lack the appropriate encryption header tied to a customer-managed KMS key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:x-amz-server-side-encryption-aws-kms-key-id
Why this is correct
The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` validates the exact KMS key ID supplied in the `x-amz-server-side-encryption-aws-kms-key-id` header, satisfying the requirement that objects use a customer-managed key. Denying PUT requests lacking this header enforces encryption at rest with the mandated key, not merely any SSE-KMS key.
- ✗
s3:x-amz-server-side-encryption
Why it's wrong here
s3:x-amz-server-side-encryption only confirms that some SSE algorithm was requested; it cannot verify the customer-managed KMS key, so it fails the stem's KMS requirement. It is tempting because it does enforce encryption headers, and would be correct if only SSE-KMS generally, not a specific key, were required.
- ✗
s3:x-amz-acl
Why it's wrong here
s3:x-amz-acl evaluates the canned ACL header, which governs object permissions rather than encryption, so it cannot enforce a KMS key. It is tempting because it is a genuine S3 request-header condition key used in bucket policies, but it addresses access control, not encryption at rest.
- ✗
aws:SourceArn
Why it's wrong here
aws:SourceArn restricts which resource may perform the action, not which encryption header a PUT carries, so it cannot deny unencrypted uploads. It is tempting because it is a legitimate condition key for scoping cross-service access, but it does not inspect encryption parameters.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.