DEA-C01 SSE-KMS Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::data-lake-bucket/*"
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::data-lake-bucket"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "arn:aws:kms:us-east-1:123456789012:key/abc123"
}
]
}
```Refer to the exhibit. An AWS Glue job is failing with 'AccessDenied' when trying to write to the 'data-lake-bucket' which is encrypted with an AWS KMS key. The IAM role used by the Glue job has the attached policy shown. What is the MOST likely cause of the failure?
⚠ Common exam trap
DEA-C01 often tests the misconception that S3 permissions alone are sufficient for encrypted buckets — candidates forget that SSE-KMS requires explicit kms:GenerateDataKey and kms:Encrypt permissions on the key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not include kms:GenerateDataKey or kms:Encrypt permission.
When an S3 bucket is encrypted with a customer-managed KMS key, any principal writing objects must have both S3 write permissions and KMS permissions to use the key. The Glue job's IAM policy lacks kms:GenerateDataKey and kms:Encrypt, so S3 rejects the PutObject with AccessDenied. Adding those KMS actions to the policy resolves the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy does not include s3:ListBucket permission.
Why it's wrong here
ListBucket governs enumerating bucket contents, not writing objects, so its absence would not block the PutObject call. It tempts because ListBucket is often needed for read workflows and its omission genuinely causes AccessDenied in those cases, but this scenario is a write to an encrypted bucket.
- ✗
The policy does not include s3:GetObject permission.
Why it's wrong here
The job writes to the bucket, so s3:GetObject is irrelevant to the failure; write operations need s3:PutObject. It tempts because GetObject is the most familiar S3 permission and missing read rights do cause AccessDenied, but that applies to reading objects, not writing them.
- ✗
The KMS key ARN in the policy is incorrect.
Why it's wrong here
An incorrect KMS key ARN would produce a KMS AccessDenied on the key itself, but the exhibit shows the policy granting kms:Decrypt and GenerateDataKey on the correct key, so the ARN is not the fault. It tempts because ARN typos are a frequent real cause of KMS denials.
- ✓
The policy does not include kms:GenerateDataKey or kms:Encrypt permission.
Why this is correct
Writing to a KMS-encrypted S3 bucket requires kms:GenerateDataKey and kms:Encrypt on the key. The attached policy grants only S3 actions, so the Glue role cannot obtain a data key, producing AccessDenied despite valid bucket permissions.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.