DVA-C02 Security Practice Question
A company uses an Amazon S3 bucket to store sensitive documents. The security team requires that all objects uploaded to the bucket must be encrypted at rest using server-side encryption with a customer-managed KMS key (SSE-KMS). A developer needs to enforce this by denying any PutObject request that does not specify the required encryption. Which bucket policy condition should be used?
⚠ Common exam trap
A common mix-up: candidates confuse the condition key for the encryption type (`s3:x-amz-server-side-encryption`) with the condition key for the specific KMS key ID (`s3:x-amz-server-side-encryption-aws-kms-key-id`), leading them to pick Option B which only enforces SSE-KMS but not a specific customer-managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
The condition `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` explicitly denies any PutObject request that does not specify the exact customer-managed KMS key ARN. This enforces SSE-KMS with a specific key, meeting the security team's requirement that all objects must be encrypted at rest using that key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
Why this is correct
This policy condition correctly enforces the use of a *specific* AWS KMS key for Server-Side Encryption (SSE-KMS) when objects are uploaded to the S3 bucket. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key checks the value of the `x-amz-server-side-encryption-aws-kms-key-id` request header. By using `StringNotEquals` with the desired KMS key ARN, any PUT object request that does *not* specify this exact ARN in the header will be denied, effectively mandating its use. This ensures sensitive documents are encrypted with the designated corporate key.
- ✗
"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}
Why it's wrong here
This condition is insufficient because it only verifies that Server-Side Encryption with AWS KMS (SSE-KMS) is enabled, but it does not enforce the use of a *particular* KMS key. The `s3:x-amz-server-side-encryption` condition key checks the `x-amz-server-side-encryption` request header, which would typically be set to `aws:kms` for SSE-KMS. While it ensures objects are encrypted with *some* KMS key, it permits the use of any KMS key, including customer-managed keys not approved for sensitive data, or even the default S3 managed KMS key, failing to meet the requirement for a specific key.
- ✗
"Condition": {"Null": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "true"}}
Why it's wrong here
This condition is incorrect because `Null: {"s3:x-amz-server-side-encryption-aws-kms-key-id": "true"}` explicitly denies any PUT object request where the `x-amz-server-side-encryption-aws-kms-key-id` header is *present*. The requirement is to enforce a *specific* KMS key, which means this header *must* be present and contain the correct ARN. Therefore, this policy would prevent users from specifying any KMS key, including the required one, making it the opposite of the desired outcome.
- ✗
"Condition": {"ArnNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
Why it's wrong here
This condition is syntactically incorrect for the specified S3 condition key. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key, which evaluates the KMS key ARN provided in the request header, expects string comparison operators like `StringEquals` or `StringNotEquals`. It does not support ARN-specific operators such as `ArnEquals` or `ArnNotEquals`. Attempting to use `ArnNotEquals` here would result in a policy evaluation error or unexpected behavior, as the operator is incompatible with the data type expected by this specific S3 condition key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.