DBS-C01 Database Security Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:us-east-1:123456789012:key/abc123",
"Condition": {
"StringEquals": {
"kms:ViaService": "s3.amazonaws.com"
}
}
}
]
}Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).
The IAM policy includes a condition that restricts kms:Decrypt to requests made through the S3 service (via the S3 service principal). If the user attempts to decrypt the object directly using the KMS API (e.g., using AWS CLI with `kms decrypt` command), the condition is not met, resulting in an 'Access Denied' error. Option A is incorrect because MFA is not mentioned in the policy. Option B is incorrect because the KMS key ID is assumed correct as per the scenario. Option C is incorrect because the policy does allow kms:Decrypt, but only conditionally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have MFA enabled.
Why it's wrong here
MFA is not required by this policy.
- ✗
The KMS key ID in the policy is incorrect.
Why it's wrong here
The key ID appears correct.
- ✗
The policy does not allow kms:Decrypt for the S3 bucket.
Why it's wrong here
The policy allows Decrypt for S3.
- ✓
The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).
Why this is correct
The condition 'kms:ViaService' ensures decryption only through S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.