DVA-C02 Security Practice Question
A company is using an S3 bucket to store sensitive documents. They need to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. The bucket policy must enforce encryption by denying uploads that do not specify the required encryption. Which bucket policy statement should be added?
⚠ Common exam trap
Many candidates confuse the condition key `s3:x-amz-server-side-encryption` with the KMS-specific key `s3:x-amz-server-side-encryption-aws:kms` (which does not exist), or they mistakenly use `Null` to check for the header's presence without validating its value, allowing SSE-S3 (AES256) uploads to bypass the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'
The bucket policy uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` to deny any upload where the header does not specify `aws:kms`. This ensures that only objects encrypted with AWS KMS (SSE-KMS) are allowed, enforcing server-side encryption at rest. The `Deny` effect combined with this condition blocks requests that either omit the encryption header or specify a different value like `AES256`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'
Why this is correct
This policy statement uses a Deny effect (implied by the question context of enforcing a specific encryption type) combined with the StringNotEquals condition. It explicitly denies any s3:PutObject request where the s3:x-amz-server-side-encryption header value is not 'aws:kms'. This effectively mandates that all uploaded objects must specify 'aws:kms' for server-side encryption, thereby enforcing the use of AWS KMS (SSE-KMS) for sensitive documents.
- ✗
Condition: StringEquals: 's3:x-amz-server-side-encryption-aws:kms': 'true'
Why it's wrong here
The condition key 's3:x-amz-server-side-encryption-aws:kms' is syntactically incorrect and not a valid S3 policy condition key. AWS S3 policies use 's3:x-amz-server-side-encryption' to specify the encryption type (e.g., 'AES256' or 'aws:kms') and 's3:x-amz-server-side-encryption-aws-kms-key-id' for a specific KMS key ARN. Consequently, a policy statement utilizing this invalid key will fail during evaluation, preventing it from achieving the desired enforcement.
- ✗
Condition: Null: 's3:x-amz-server-side-encryption': 'true'
Why it's wrong here
Using 'Condition: Null: 's3:x-amz-server-side-encryption': 'true'' in a Deny statement means that the action is denied if the 's3:x-amz-server-side-encryption' header *is present*. This is the opposite of the intended goal, which is to deny if encryption is *not* specified or not of a specific type. Furthermore, even if the condition were correctly inverted to deny when the header is *not* present, it would still permit any specified encryption type (SSE-S3, SSE-C, or SSE-KMS), failing to enforce KMS specifically.
- ✗
Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'
Why it's wrong here
This condition, when used in a Deny statement, explicitly prevents uploads where the 's3:x-amz-server-side-encryption' header is *not* equal to 'AES256'. This means it *allows* uploads that specify 'AES256' (SSE-S3) because they match the exclusion. Crucially, it also *allows* uploads specifying 'aws:kms' (SSE-KMS) because 'aws:kms' is not equal to 'AES256'. Therefore, this policy fails to enforce *only* KMS encryption, as it permits both SSE-S3 and SSE-KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.