DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use S3 server-side encryption with S3-managed keys (SSE-S3).

  Why it's wrong here

  Using S3 server-side encryption with S3-managed keys (SSE-S3) encrypts objects using keys entirely managed by AWS, where AWS handles key management and rotation. While it provides encryption at rest, it does not offer customer-specific control over the decryption process through KMS key policies or IAM. Therefore, SSE-S3 cannot be used to grant a specific role `kms:Decrypt` permissions, as the customer does not directly manage the encryption key or its access policies.

• ✓

  Create a KMS key policy that grants the role the kms:Decrypt permission.

  Why this is correct

  A KMS key policy is the primary authorization mechanism for a Customer Managed Key (CMK), explicitly defining which IAM principals can perform cryptographic operations. Granting the `kms:Decrypt` permission to a specific role within the key policy directly enables that role to decrypt data encrypted by the CMK. This direct control over key usage is fundamental for fine-grained access management, ensuring only authorized entities can access sensitive data.

• ✗

  Enable automatic key rotation for the KMS key.

  Why it's wrong here

  Enabling automatic key rotation for a KMS key generates new underlying cryptographic material annually for the same key ID. This practice enhances the long-term security posture by limiting the amount of data encrypted with a single key version, reducing the impact of a potential key compromise. However, key rotation is a security hygiene feature and does not alter or restrict the access permissions defined in the key policy or IAM policies for who can use the key.

• ✗

  Use an S3 bucket policy to restrict access to the role.

  Why it's wrong here

  An S3 bucket policy governs access to objects within a specific S3 bucket, controlling actions like `s3:GetObject` or `s3:PutObject`. While it can restrict which principals can retrieve an encrypted object from S3, it does not grant or deny the separate `kms:Decrypt` permission required to actually decrypt the object if it was encrypted with a KMS Customer Managed Key. The S3 bucket policy only controls access to the encrypted data in S3, not the underlying KMS key itself.