DEA-C01 Data Store Management Practice Question
A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be added to enforce this requirement?
⚠ Common exam trap
The DEA-C01 exam often tests the distinction between enforcing a specific encryption type (SSE-KMS) versus simply requiring encryption (any type), so candidates may incorrectly choose Option D (deny if not set) or Option C (deny if not AES256) because they confuse 'encryption at rest' with 'SSE-KMS specifically'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'
It denies any S3 PUT request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing SSE-KMS encryption for all objects uploaded to the bucket. This bucket policy condition ensures that only requests specifying AWS KMS-managed keys are allowed, meeting the security team's requirement for automatic encryption at rest with SSE-KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny put requests where 's3:x-amz-server-side-encryption' is 'aws:kms'
Why it's wrong here
This denies exactly the aws:kms requests the requirement demands, inverting the condition; SSE-S3 and unencrypted uploads would pass. It tempts because a Deny statement keyed on s3:x-amz-server-side-encryption is the correct enforcement mechanism, but the StringNotEquals operator is required, not StringEquals.
- ✓
Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'
Why this is correct
A bucket policy denying `s3:PutObject` when `s3:x-amz-server-side-encryption` is absent or not `aws:kms` enforces SSE-KMS at upload time, satisfying the requirement that every object be encrypted with AWS KMS managed keys. The condition key inspects the request header, blocking non-compliant uploads before they succeed.
- ✗
Deny put requests where 's3:x-amz-server-side-encryption' is not 'AES256'
Why it's wrong here
AES256 specifies SSE-S3, not SSE-KMS, so this policy denies the very aws:kms requests the requirement mandates while permitting SSE-S3 uploads. It tempts because denying unencrypted-header PUTs is the right enforcement pattern, but the header value checked must be aws:kms.
- ✗
Deny put requests where 's3:x-amz-server-side-encryption' is not set
Why it's wrong here
Checking only that the header is present permits any value, including AES256 (SSE-S3), so SSE-KMS is not enforced. It tempts because denying PUTs lacking an encryption header blocks default unencrypted uploads, which satisfies a weaker 'encryption required' requirement rather than the KMS-specific one.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.