DEA-C01 Data Operations and Support Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

A data engineer creates an IAM policy as shown in the exhibit. The engineer then attaches this policy to an IAM role used by an application that uploads objects to the S3 bucket 'my-bucket'. When the application uploads an object without specifying server-side encryption, what happens?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The upload fails with a 403 Access Denied error.

The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present and set to `AES256`. If the application uploads an object without specifying server-side encryption, this condition is not met, so the request is denied with a 403 Access Denied error. Options A, C, and D are incorrect because the upload fails and the object is not stored at all.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The object is uploaded with SSE-S3 encryption by default.
Why it's wrong here
Default encryption does not satisfy the condition if not specified in the request.
✓
The upload fails with a 403 Access Denied error.
Why this is correct
The condition is not met, so the request is denied.
✗
The object is uploaded without encryption.
Why it's wrong here
The policy denies requests without encryption.
✗
The object is uploaded with SSE-C encryption.
Why it's wrong here
The condition requires AES256, not SSE-C.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Operations and Support Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question