DVA-C02 Security Practice Question
A company requires that all data in Amazon S3 be encrypted at rest using server-side encryption with a customer-managed KMS key. The developer needs to ensure that any object uploaded without the x-amz-server-side-encryption header set to aws:kms is denied. How can this be enforced?
⚠ Common exam trap
Many exam-takers confuse default encryption (which silently applies encryption but does not deny non-compliant uploads) with a bucket policy that actively denies requests, leading them to choose Option B as a simpler but ineffective solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a bucket policy that denies s3:PutObject if the encryption condition is not met.
An S3 bucket policy with a condition that denies s3:PutObject unless the `s3:x-amz-server-side-encryption` header equals `aws:kms` enforces server-side encryption with a customer-managed KMS key at the API level. This policy explicitly rejects any upload that does not include the required encryption header, ensuring compliance even if default encryption is bypassed or misconfigured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a bucket policy that denies s3:PutObject if the encryption condition is not met.
Why this is correct
A bucket policy with a Deny effect on the s3:PutObject action can explicitly check for the presence of server-side encryption headers. By using a condition like StringNotEquals on s3:x-amz-server-side-encryption or Null for its absence, the policy will reject any upload that does not specify the required encryption. This mechanism directly enforces the company's encryption mandate at the point of ingestion, preventing non-compliant data from being stored.
- ✗
Configure default encryption on the bucket with SSE-KMS.
Why it's wrong here
Configuring default encryption with SSE-KMS ensures that any object uploaded to the S3 bucket will be encrypted if no specific encryption headers are provided by the uploader. However, this mechanism does not deny the s3:PutObject request if the encryption condition is not met. Instead, it transparently applies the default encryption, allowing the upload to succeed without enforcing a client-side encryption declaration.
- ✗
Enable S3 Object Lock.
Why it's wrong here
S3 Object Lock is designed to prevent objects from being deleted or overwritten for a fixed or indefinite period, supporting WORM (Write Once Read Many) compliance. While crucial for data retention and regulatory compliance, Object Lock operates on the immutability of stored objects and has no functionality to inspect or enforce encryption headers during the PutObject API call. Therefore, it is irrelevant for enforcing encryption at the time of upload.
- ✗
Use a CloudTrail trail to monitor uploads.
Why it's wrong here
An AWS CloudTrail trail records API calls made to AWS services, including s3:PutObject operations, providing an audit log of activities. While invaluable for security auditing, compliance, and troubleshooting, CloudTrail is a monitoring service that logs events after they occur. It does not possess any capability to intercept or deny API requests based on specific conditions like the absence of encryption headers, thus failing to enforce encryption proactively.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.