DEA-C01 Data Security and Governance Practice Question

Exhibit

{
  "Effect": "Allow",
  "Action": ["kms:Decrypt"],
  "Resource": "*",
  "Condition": {
    "ForAnyValue:StringEquals": {
      "kms:EncryptionContextKeys": ["service", "aws:pi"],
      "kms:EncryptionContext": {
        "aws:pi": "db-123"
      }
    }
  }
}

Refer to the exhibit. An IAM policy includes the above statement to allow decryption of a KMS key under specific conditions. What does this policy allow?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Decrypt data that was encrypted with the encryption context {"aws:pi":"db-123"}

The policy allows the Decrypt action on the KMS key only when the encryption context condition is met, specifically the key 'aws:pi' with value 'db-123'. This means only data encrypted with that encryption context can be decrypted. Option A is incorrect because the condition restricts to a specific encryption context, not any KMS key. Option C is incorrect because the action is Decrypt, not Encrypt. Option D is incorrect because decryption without the required encryption context would not satisfy the condition.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Decrypt any data encrypted with any KMS key
Why it's wrong here
The condition restricts the context.
✓
Decrypt data that was encrypted with the encryption context {"aws:pi":"db-123"}
Why this is correct
The condition matches that context.
✗
Encrypt data with the KMS key using the specified encryption context
Why it's wrong here
The action is Decrypt, not Encrypt.
✗
Decrypt data encrypted with the KMS key without any encryption context
Why it's wrong here
The condition requires the context.

Go deeper

DEA-C01 Data Security and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question