DVA-C02 Security Practice Question
A company requires that all objects uploaded to an Amazon S3 bucket are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The developer wants to enforce this with a bucket policy. Which condition key and value should be used in the policy to deny uploads that do not meet this requirement?
⚠ Common exam trap
Candidates often confuse the condition key for SSE-S3 (`s3:x-amz-server-side-encryption` with value `AES256`) with the condition key for SSE-KMS (`s3:x-amz-server-side-encryption-aws-kms-key-id`), or mistakenly think `aws:SecureTransport` enforces encryption at rest instead of in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption equals AES256
The condition key `s3:x-amz-server-side-encryption` with value `AES256` directly checks that the request header `x-amz-server-side-encryption` is set to `AES256`, which is the required value for SSE-S3. By using this condition in a bucket policy with a Deny effect, any upload that does not include this header or includes a different value (e.g., `aws:kms`) will be rejected, enforcing server-side encryption with Amazon S3 managed keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:x-amz-server-side-encryption equals AES256
Why this is correct
This condition key, "s3:x-amz-server-side-encryption", directly evaluates the "x-amz-server-side-encryption" header included in an S3 PUT request. Specifying "AES256" mandates the use of Server-Side Encryption with Amazon S3-managed keys (SSE-S3), ensuring that S3 automatically encrypts objects using the AES-256 algorithm before storing them. This is the precise and correct method within a bucket policy to enforce encryption at rest for all uploaded objects without requiring AWS KMS.
- ✗
s3:x-amz-server-side-encryption-aws-kms-key-id equals alias/aws/s3
Why it's wrong here
The "s3:x-amz-server-side-encryption-aws-kms-key-id" condition key is specifically designed to enforce the use of a particular AWS Key Management Service (KMS) key for Server-Side Encryption with KMS keys (SSE-KMS). While "alias/aws/s3" is a valid default KMS key for S3, this condition alone does not enforce SSE-S3. It would instead enforce SSE-KMS, which is a distinct encryption method requiring the "x-amz-server-side-encryption: aws:kms" header, not just the key ID.
- ✗
aws:SecureTransport equals true
Why it's wrong here
The "aws:SecureTransport" condition key is used to ensure that all requests made to the S3 bucket are transmitted over an encrypted connection, specifically HTTPS. While vital for protecting data in transit from eavesdropping, this condition does not enforce encryption of the data once it is stored within S3. It addresses network security, not the requirement for server-side encryption at rest.
- ✗
s3:object-lock-mode equals GOVERNANCE
Why it's wrong here
The "s3:object-lock-mode" condition key is utilized to enforce Amazon S3 Object Lock settings, such as "GOVERNANCE" or "COMPLIANCE" modes. These modes are designed to prevent objects from being deleted or overwritten for a specified retention period, ensuring data immutability and compliance. This feature is entirely unrelated to encrypting the data itself; it focuses on data retention policies rather than encryption at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.