DVA-C02 Development with AWS Services Practice Question
A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?
⚠ Common exam trap
Candidates often assume enabling default encryption on the bucket is sufficient, overlooking that the IAM principal must also be explicitly authorized to use the KMS key via the key policy or IAM policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the IAM user/role permissions to use the key.
When default encryption is enabled on an S3 bucket with a KMS CMK, the S3 service uses the CMK to encrypt objects at rest. However, the IAM user or role making the PUT request must have explicit permissions to use that CMK, typically via the kms:GenerateDataKey and kms:Decrypt actions in the KMS key policy. If the key policy does not grant these permissions to the principal, the request fails with an 'Access Denied' error, even though the bucket policy and IAM permissions are otherwise correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket's object ownership is set to BucketOwnerPreferred.
Why it's wrong here
The S3 bucket's object ownership setting, such as BucketOwnerPreferred, primarily governs how Access Control Lists (ACLs) are handled for objects uploaded by different AWS accounts, influencing object ownership and access control at the object level. This setting does not directly control the fundamental permissions required for an IAM principal to perform server-side encryption using a KMS key during a PutObject operation. An Access Denied error specifically related to encryption typically points to a lack of authorization for the encryption process itself, not an object ownership conflict.
- ✓
The KMS key policy does not grant the IAM user/role permissions to use the key.
Why this is correct
When an IAM user or role attempts to upload an object to S3 using server-side encryption with AWS KMS (SSE-KMS), S3 makes a request to AWS KMS on behalf of the uploader to generate a data key. This operation specifically requires the IAM principal to have `kms:GenerateDataKey` permissions on the specified AWS KMS key. If the KMS key policy does not explicitly allow or implicitly denies this action for the calling principal, the `PutObject` request will fail with an `Access Denied` error because S3 cannot obtain the necessary encryption key from KMS.
- ✗
The KMS key is in a different AWS Region than the S3 bucket.
Why it's wrong here
AWS KMS keys are strictly regional resources, meaning they can only be used within the AWS Region where they were created. For S3 server-side encryption with KMS (SSE-KMS), the specified KMS key must reside in the same AWS Region as the S3 bucket. Attempting to use a KMS key from a different region will not result in a generic `Access Denied` error but rather a specific error indicating that the KMS key is not found or is in an invalid region for the S3 bucket, preventing the encryption operation from proceeding.
- ✗
The S3 bucket policy denies PutObject without encryption.
Why it's wrong here
An S3 bucket policy can enforce server-side encryption by denying `PutObject` requests that do not include specific encryption headers, such as `s3:x-amz-server-side-encryption`. If such a policy were in place and the user *was* attempting to upload with encryption (e.g., SSE-KMS), this condition would be met, and the policy would not deny the request. If the encryption *itself* failed due to a lack of KMS permissions, the error would originate from the KMS interaction, not from the S3 bucket policy's encryption enforcement, which would typically result in a different, more specific error message.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.