DVA-C02 Development with AWS Services Practice Question
A developer is using Amazon S3 to store sensitive data. The compliance team requires that all objects be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). Which THREE steps must the developer take to enforce this requirement? (Choose THREE.)
⚠ Common exam trap
It's easy for candidates to confuse S3 default encryption (which can be set to SSE-KMS) with bucket policies that enforce encryption headers, but the question requires both the key creation (A) and the enforcement mechanisms (C and E) to fully satisfy the compliance requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an AWS KMS customer-managed key.
SSE-KMS requires a customer-managed AWS KMS key to encrypt objects at rest. By creating a customer-managed key, the developer gains control over key rotation, access policies, and audit trails, which satisfies the compliance team's requirement for server-side encryption with a customer-managed key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an AWS KMS customer-managed key.
Why this is correct
To implement Server-Side Encryption with AWS KMS (SSE-KMS) for sensitive data, creating an AWS KMS customer-managed key (CMK) is a fundamental prerequisite. This key provides the developer with full control over the encryption process, including key policies, rotation, and audit trails, which is crucial for meeting stringent compliance requirements. Without a CMK, the enhanced security and control offered by SSE-KMS cannot be leveraged for data protection.
- ✗
Configure the bucket ACL to require encryption.
Why it's wrong here
Amazon S3 Access Control Lists (ACLs) are designed to manage object-level and bucket-level permissions, specifying who can access data and what actions they can perform. However, ACLs do not offer any functionality or configuration options to enforce or require server-side encryption for objects uploaded to an S3 bucket. Encryption enforcement is managed through bucket policies or default encryption settings, making ACLs irrelevant for this purpose.
- ✓
Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.
Why this is correct
A bucket policy is a powerful mechanism to enforce specific security requirements, such as mandatory server-side encryption, for all objects uploaded to an S3 bucket. By configuring a policy that explicitly denies `s3:PutObject` requests unless the `x-amz-server-side-encryption` header is present and set to 'aws:kms', the developer ensures all new objects are encrypted using AWS KMS. This provides a robust, mandatory layer of protection for sensitive data at the point of ingestion.
- ✗
Enable S3 default encryption with SSE-S3.
Why it's wrong here
While enabling S3 default encryption with SSE-S3 does encrypt objects at rest, it utilizes Amazon S3-managed encryption keys, not customer-managed keys. For sensitive data requiring higher control and auditability, SSE-S3 falls short because it does not provide the granular key management, custom access policies, or direct control over the encryption key lifecycle that a customer-managed key (CMK) offers through AWS KMS.
- ✓
Set the bucket's default encryption to SSE-KMS using the customer-managed key.
Why this is correct
Setting the bucket's default encryption to SSE-KMS with a specified customer-managed key ensures that all objects uploaded to the bucket are automatically encrypted using that key, even if the `x-amz-server-side-encryption` header is not explicitly included in the `PutObject` request. This establishes a strong baseline for data protection, guaranteeing that sensitive data is always encrypted at rest with a key under the developer's direct control, preventing unencrypted uploads.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.