DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  s3:x-amz-server-side-encryption equals 'aws:kms'

  Why this is correct

  This condition directly checks for the presence and specific value of the `x-amz-server-side-encryption` request header. When set to `aws:kms`, it mandates that Amazon S3 encrypts the object using Server-Side Encryption with AWS KMS (SSE-KMS) during the upload operation. This is the fundamental policy condition to enforce SSE-KMS for all new objects uploaded to the bucket, ensuring data is encrypted at rest using a customer-managed key or AWS-managed key within KMS.

• ✗

  s3:x-amz-server-side-encryption-aws-kms-key-id equals the KMS key ARN

  Why it's wrong here

  While this condition is crucial for enforcing the use of a *specific* AWS KMS key (identified by its ARN) for encryption, it does not inherently *require* that server-side encryption with KMS is enabled in the first place. An upload request could omit the `x-amz-server-side-encryption` header entirely, resulting in no server-side encryption, and this condition would not be evaluated. Therefore, it must be combined with the `s3:x-amz-server-side-encryption` condition to ensure both encryption *and* the specific key are used.

• ✗

  s3:x-amz-acl equals 'bucket-owner-full-control'

  Why it's wrong here

  This condition specifically relates to the `x-amz-acl` request header, which controls the object's Access Control List (ACL) at the time of upload. Setting it to `bucket-owner-full-control` grants the bucket owner full control over the uploaded object, even if the uploader is a different account. This mechanism is entirely separate from server-side encryption and does not influence how data is protected at rest, focusing instead on object ownership and permissions.

• ✗

  s3:signatureversion equals 'AWS4-HMAC-SHA256'

  Why it's wrong here

  This condition evaluates the signature version used to authenticate the request to Amazon S3. `AWS4-HMAC-SHA256` refers to Signature Version 4, which is the latest and most secure authentication protocol for AWS requests. While enforcing Signature Version 4 is a security best practice for request integrity and authentication, it has no direct bearing on whether the *data itself* is encrypted at rest within S3. It only ensures the request itself is securely signed.