DVA-C02 Security Practice Question
A company stores sensitive data in Amazon S3. The security team requires that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). The developer needs to enforce that any PutObject request that does not specify the 'x-amz-server-side-encryption' header with value 'aws:kms' is denied. Which S3 bucket policy condition should be used?
⚠ Common exam trap
Many exam-takers confuse the condition key for the encryption header (`s3:x-amz-server-side-encryption`) with the condition key for the KMS key ID (`s3:x-amz-server-side-encryption-aws-kms-key-id`), mistakenly choosing Option B to enforce SSE-KMS instead of the correct header-based condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption equals 'aws:kms'
The condition key `s3:x-amz-server-side-encryption` in an S3 bucket policy can be used to require that the `x-amz-server-side-encryption` header is set to `aws:kms` on every PutObject request. This enforces server-side encryption with AWS KMS (SSE-KMS) at the bucket policy level, denying any request that omits or uses a different encryption header value.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:x-amz-server-side-encryption equals 'aws:kms'
Why this is correct
This condition directly checks for the presence and specific value of the `x-amz-server-side-encryption` request header. When set to `aws:kms`, it mandates that Amazon S3 encrypts the object using Server-Side Encryption with AWS KMS (SSE-KMS) during the upload operation. This is the fundamental policy condition to enforce SSE-KMS for all new objects uploaded to the bucket, ensuring data is encrypted at rest using a customer-managed key or AWS-managed key within KMS.
- ✗
s3:x-amz-server-side-encryption-aws-kms-key-id equals the KMS key ARN
Why it's wrong here
While this condition is crucial for enforcing the use of a *specific* AWS KMS key (identified by its ARN) for encryption, it does not inherently *require* that server-side encryption with KMS is enabled in the first place. An upload request could omit the `x-amz-server-side-encryption` header entirely, resulting in no server-side encryption, and this condition would not be evaluated. Therefore, it must be combined with the `s3:x-amz-server-side-encryption` condition to ensure both encryption *and* the specific key are used.
- ✗
s3:x-amz-acl equals 'bucket-owner-full-control'
Why it's wrong here
This condition specifically relates to the `x-amz-acl` request header, which controls the object's Access Control List (ACL) at the time of upload. Setting it to `bucket-owner-full-control` grants the bucket owner full control over the uploaded object, even if the uploader is a different account. This mechanism is entirely separate from server-side encryption and does not influence how data is protected at rest, focusing instead on object ownership and permissions.
- ✗
s3:signatureversion equals 'AWS4-HMAC-SHA256'
Why it's wrong here
This condition evaluates the signature version used to authenticate the request to Amazon S3. `AWS4-HMAC-SHA256` refers to Signature Version 4, which is the latest and most secure authentication protocol for AWS requests. While enforcing Signature Version 4 is a security best practice for request integrity and authentication, it has no direct bearing on whether the *data itself* is encrypted at rest within S3. It only ensures the request itself is securely signed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.