DVA-C02 Security Practice Question
A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?
⚠ Common exam trap
Watch out — candidates often confuse `kms:Decrypt` with `kms:GenerateDataKey` or `kms:ReEncrypt`, mistakenly thinking those actions are required for decryption, when in fact they also enable encryption capabilities that violate the requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kms:Decrypt
The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kms:Decrypt
Why this is correct
The `kms:Decrypt` permission is essential for retrieving and accessing S3 objects that have been encrypted using AWS KMS. When an application attempts to download an S3 object encrypted with a KMS key, S3 internally requests the KMS service to decrypt the data key associated with that object. This action allows the S3 service, on behalf of the requesting principal, to decrypt the object's content and return it in plaintext.
- ✗
kms:GenerateDataKey
Why it's wrong here
The `kms:GenerateDataKey` permission is used to create a unique data key for client-side encryption or for server-side encryption by services like S3. This action is part of the *encryption* process, where a data key is generated, used to encrypt the object data, and then encrypted itself by the KMS key. It does not facilitate the decryption of existing ciphertext or the retrieval of plaintext from encrypted S3 objects.
- ✗
kms:Encrypt
Why it's wrong here
The `kms:Encrypt` permission allows a principal to encrypt plaintext data using a specified KMS key, producing ciphertext. This action is fundamental for the *initial encryption* of data, such as when uploading new objects to S3 with KMS server-side encryption. However, it is the opposite operation of what is required to access and read already encrypted S3 objects, which necessitates decryption.
- ✗
kms:ReEncrypt
Why it's wrong here
The `kms:ReEncrypt` permission is used to change the KMS key under which data is encrypted, or to re-encrypt data under the same key but potentially with a different encryption context. While this operation internally involves both decryption and subsequent encryption, its purpose is data transformation, not direct plaintext retrieval. To simply access the unencrypted content of an S3 object, the specific `kms:Decrypt` permission is required.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.