DEA-C01 Data Store Management Practice Question
A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to a specific S3 bucket are automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be added to enforce this requirement?
⚠ Common exam trap
The DEA-C01 exam often tests the distinction between enforcing a specific encryption type (SSE-KMS) versus simply requiring encryption (any type), so candidates may incorrectly choose Option D (deny if not set) or Option C (deny if not AES256) because they confuse 'encryption at rest' with 'SSE-KMS specifically'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'
It denies any S3 PUT request that does not include the `x-amz-server-side-encryption` header set to `aws:kms`, thereby enforcing SSE-KMS encryption for all objects uploaded to the bucket. This bucket policy condition ensures that only requests specifying AWS KMS-managed keys are allowed, meeting the security team's requirement for automatic encryption at rest with SSE-KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny put requests where 's3:x-amz-server-side-encryption' is 'aws:kms'
Why it's wrong here
This would prevent SSE-KMS, the opposite of what is required.
- ✓
Deny put requests where 's3:x-amz-server-side-encryption' is not 'aws:kms'
Why this is correct
This enforces SSE-KMS encryption.
- ✗
Deny put requests where 's3:x-amz-server-side-encryption' is not 'AES256'
Why it's wrong here
This enforces SSE-S3, not SSE-KMS.
- ✗
Deny put requests where 's3:x-amz-server-side-encryption' is not set
Why it's wrong here
This denies unencrypted uploads but still allows SSE-S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.