DVA-C02 Security Practice Question
A developer is using an S3 bucket to store sensitive files. The bucket policy includes a condition that requires TLS for all requests. A user reports that they can access the bucket via the AWS Management Console but not via an application using HTTP. What is the likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket policy denies HTTP requests via aws:SecureTransport condition.
The condition aws:SecureTransport requires HTTPS; the application uses HTTP, which violates the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application is using an expired IAM access key.
Why it's wrong here
An expired IAM access key would cause the SDK to return an authentication error such as InvalidAccessKeyId or SignatureDoesNotMatch for every request, regardless of whether the transport is HTTP or HTTPS. The symptom described is protocol-dependent, but key expiration is not. The console would also fail if it relied on the same expired key, so this cannot explain why the console works while the application fails.
- ✓
The bucket policy denies HTTP requests via aws:SecureTransport condition.
Why this is correct
A bucket policy with an aws:SecureTransport condition set to false explicitly denies any request that is not sent over HTTPS. The AWS Management Console always uses the HTTPS protocol, so requests from the console satisfy the condition and succeed. However, the application is sending plain HTTP requests, which fail the condition and receive a 403 Access Denied, exactly matching the reported behavior.
- ✗
The S3 bucket is in a different region.
Why it's wrong here
If the bucket were in a different region, every request routed through the SDK or console would receive a 301 PermanentRedirect with the correct regional endpoint, but the console would still succeed after redirecting. The failure mode would not be specific to HTTP; both the console and the application would be redirected or fail. A region mismatch would not cause an HTTP-only access denied, so this is not the root cause.
- ✗
The application is not signing requests with Signature Version 4.
Why it's wrong here
Signature Version 4 is required for authenticating all AWS API requests, but it only proves who is sending the request; it does not secure the transport. Even a validly signed request sent over HTTP would violate an aws:SecureTransport deny policy because the condition inspects the connection, not the signature. An incorrect SigV4 implementation would instead produce SignatureDoesNotMatch errors on all requests, not just HTTP ones.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.