DEA-C01 S3 Bucket Policy Conditions Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineerRole"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/data/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

Refer to the exhibit. An S3 bucket policy is shown. A data engineer using the DataEngineerRole tries to upload an object to s3://example-bucket/data/report.csv with SSE-S3 encryption. The upload fails. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition requires SSE-S3 encryption header, but the upload did not include it.

The bucket policy includes a condition that the request must include the `x-amz-server-side-encryption` header with value `AES256` (SSE-S3). The upload did not include this header, so the policy condition was not met, resulting in a failed upload. Option A is incorrect because the resource ARN matches the object path. Option B is incorrect because the role has the `s3:PutObject` permission. Option D is incorrect because the principal (DataEngineerRole) is allowed by the policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN does not match the object.
Why it's wrong here
The ARN matches the object path.
✗
The role does not have s3:PutObject permission.
Why it's wrong here
The policy grants s3:PutObject.
✓
The condition requires SSE-S3 encryption header, but the upload did not include it.
Why this is correct
The condition requires the encryption header to be present and set to AES256.
✗
The principal is not authorized.
Why it's wrong here
The principal is the DataEngineerRole.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

3 more ways this is tested on DEA-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A data engineer needs to ensure that data in an S3 bucket is encrypted at rest. The bucket policy includes a condition that denies PutObject requests if the object is not encrypted. Which S3 encryption feature does this enforce?

easy

A.S3 Object Lock
B.S3 MFA Delete
C.S3 Default Encryption
✓ D.S3 Bucket Policy

Why D: S3 bucket policies can require server-side encryption by denying PutObject without encryption headers. Option C (default encryption) is a bucket-level setting that automatically encrypts objects, but it does not enforce encryption via policy. Option A (object lock) prevents deletion. Option B (MFA delete) requires multi-factor authentication.

Variation 2. A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket contains objects uploaded by various applications. What is the simplest method to enforce encryption for all new objects?

easy

A.Enable S3 Block Public Access to block public access to the bucket.
B.Enable default encryption on the S3 bucket using S3-Managed Keys (SSE-S3).
C.Enable S3 Object Lock on the bucket.
✓ D.Configure an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.

Why D: An S3 bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all new objects. Option A is wrong because S3 Block Public Access does not enforce encryption. Option B is wrong because default encryption applies only if the upload request does not specify encryption headers; it does not enforce encryption for requests that specify 'None'. Option C is wrong because S3 Object Lock prevents deletion but does not enforce encryption.

Variation 3. A data engineer needs to ensure that all data stored in an S3 bucket is encrypted at rest. Which S3 bucket policy condition key should be used to enforce encryption using AWS KMS?

easy

A.s3:x-amz-server-side-encryption
B.kms:EncryptionContext
C.s3:x-amz-acl
✓ D.s3:x-amz-server-side-encryption-aws-kms-key-id

Why D: The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to enforce that a specific KMS key is used for server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because s3:x-amz-server-side-encryption only checks whether server-side encryption is enabled, but does not require a specific KMS key. Option B is incorrect because kms:EncryptionContext is a condition key used in KMS policies, not S3 bucket policies. Option C is incorrect because s3:x-amz-acl is used for access control lists, not encryption.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.

DEA-C01 S3 Bucket Policy Conditions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question

3 more ways this is tested on DEA-C01