DEA-C01 Data Security and Governance Practice Question

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

Refer to the exhibit. A data engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Allows only HTTPS requests to get and put objects, and denies HTTP requests.

The bucket policy allows GetObject and PutObject actions only when the request uses HTTPS, and explicitly denies all S3 actions when the request uses HTTP due to the condition `aws:SecureTransport=false`. Therefore, only HTTPS requests for Get and Put are permitted. Option A is incorrect because the policy does not restrict by IP addresses. Option C is incorrect because both Get and Put are allowed over HTTPS, not just Get. Option D is incorrect because the policy does not grant anonymous access; it requires secure transport and does not allow HTTP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allows access only from specific IP addresses.
Why it's wrong here
The policy's condition keys and actions determine its effect; if it grants broad actions rather than restricting by aws:SourceIp, it does not limit access to specific IP addresses. IP restriction is tempting because aws:SourceIp conditions are common in bucket policies, and would be correct if the exhibit showed that condition.
✓
Allows only HTTPS requests to get and put objects, and denies HTTP requests.
Why this is correct
The policy's `aws:SecureTransport` condition evaluates the request protocol, so `"aws:SecureTransport": "false"` in a Deny statement blocks any non-TLS call. This satisfies the stem's requirement to enforce encryption in transit: plain HTTP `GetObject` and `PutObject` attempts are rejected, while HTTPS equivalents remain permitted.
✗
Allows only GetObject actions over HTTPS.
Why it's wrong here
The policy does not restrict to GetObject over HTTPS unless its Action lists only s3:GetObject and its condition enforces aws:SecureTransport true. HTTPS-only enforcement is tempting because aws:SecureTransport is a standard bucket policy condition, and would be correct if the exhibit included that statement.
✗
Allows anonymous access to get and put objects over HTTP.
Why it's wrong here
The policy does not grant anonymous get and put over HTTP unless it uses Principal "*" with s3:GetObject and s3:PutObject and no aws:SecureTransport condition. Anonymous access is tempting because public bucket policies exist, and would be correct if the exhibit showed a wildcard principal without TLS enforcement.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on DEA-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. A data engineer applied this bucket policy to an S3 bucket. What is the effect of this policy?

medium

A.Allows only HTTPS requests to get objects
✓ B.Blocks HTTP requests to get objects
C.Allows only HTTP requests to get objects
D.Blocks all access to the bucket

Why B: The bucket policy shown denies requests where aws:SecureTransport is false, which means any request not using HTTPS (i.e., HTTP) is denied. Since the policy targets the s3:GetObject action, the effect is that HTTP requests to get objects are blocked, while HTTPS requests remain allowed.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Timed practice sets

Work through a scored set and see where your weak spots actually are.

DEA-C01 Practice Test 2 — 25 Questions→DEA-C01 Practice Exam 2 — 20 Questions→DEA-C01 Practice Exam 1 — 20 Questions→

Domain-focused practice

Each of these maps to a scored section of the exam blueprint.

Data Security and Governance Data Operations and Support Data Store Management Data Ingestion and Transformation

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Topic-level practice

Target a specific weak area. Each page focuses on one exam topic with questions, explanations and a concept guide.

Data Security and Governance practice questions DEA-C01 fundamentals practice questions DEA-C01 scenario practice questions

Continue studying

Study guide Exam domains AWS Certified Data Engineer Associate DEA-C01 exam guide

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.