DVA-C02 Security Practice Question
A company has an S3 bucket that stores sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. Additionally, they want to enforce that objects are not uploaded without encryption. Which bucket policy should be used?
⚠ Common exam trap
Many candidates confuse the encryption header values (`aws:kms` vs `AES256`) or mistakenly think that an Allow statement alone can enforce encryption, when in fact a Deny statement with a condition is required to block non-compliant requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms
It uses a Deny effect with a condition that checks for the presence and value of the `x-amz-server-side-encryption` header. This policy explicitly denies any `s3:PutObject` request that does NOT include `x-amz-server-side-encryption` with the value `aws:kms`, thereby enforcing server-side encryption with AWS KMS (SSE-KMS) on all uploads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny s3:PutObject if the request includes x-amz-server-side-encryption
Why it's wrong here
This policy statement would explicitly deny any `s3:PutObject` request that includes the `x-amz-server-side-encryption` header, regardless of its value. Consequently, it would prevent all forms of server-side encryption (SSE-S3, SSE-KMS, SSE-C) from being used for uploads. This directly contradicts the objective of securing sensitive customer data through encryption, as it would either force unencrypted uploads or require client-side encryption, which is not what the question implies.
- ✓
Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms
Why this is correct
This bucket policy statement correctly enforces Server-Side Encryption with AWS KMS (SSE-KMS) for all objects uploaded to the S3 bucket. By using a `Deny` effect with a `StringNotEquals` condition on the `s3:x-amz-server-side-encryption` header, it ensures that any `PutObject` request that does not explicitly specify `aws:kms` for server-side encryption will be rejected. This guarantees that all sensitive customer data at rest is protected by customer-managed or AWS-managed KMS keys.
- ✗
Allow s3:PutObject only if the request uses a specific KMS key
Why it's wrong here
An `Allow` policy statement that restricts the use of a specific KMS key only applies if server-side encryption with KMS (SSE-KMS) is already being requested. This policy does not, however, *enforce* that SSE-KMS must be used in the first place. An attacker or misconfigured application could still upload objects without any server-side encryption, as this policy does not explicitly deny unencrypted uploads, failing to meet the security requirement for sensitive data.
- ✗
Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value AES256
Why it's wrong here
This policy statement enforces server-side encryption, but it specifically mandates `AES256`, which corresponds to Server-Side Encryption with S3-managed keys (SSE-S3). While SSE-S3 encrypts data at rest, it uses encryption keys entirely managed by AWS, without customer control over the key lifecycle. For 'sensitive customer data,' requirements often dictate the use of AWS KMS (SSE-KMS) to provide greater control and auditability over the encryption keys, making SSE-S3 an insufficient choice in this context.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.