DVA-C02 Security Practice Question
A developer receives an AccessDenied error when trying to upload a file to an S3 bucket that has a bucket policy requiring encryption in transit. What is the most likely cause?
⚠ Common exam trap
DVA-C02 often tests the distinction between encryption at rest and encryption in transit — candidates see 'encryption' in the bucket policy and incorrectly assume SSE is missing, when the condition is actually about HTTPS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request is not using HTTPS
A bucket policy that requires encryption in transit typically uses a condition like aws:SecureTransport: true, which evaluates to false for HTTP requests. If the SDK or client sends the PutObject request over HTTP instead of HTTPS, the condition fails and S3 returns AccessDenied. The most likely cause is that the request is not using HTTPS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The object is not encrypted with server-side encryption
Why it's wrong here
Server-side encryption (SSE) pertains to how data is encrypted when it is stored at rest within Amazon S3, not during its transmission from the client to S3. While S3 bucket policies can enforce the use of SSE for uploaded objects, an `AccessDenied` error specifically due to a lack of encryption *in transit* indicates a failure to meet a secure transport requirement, not an issue with the object's eventual at-rest encryption status. Therefore, the object's server-side encryption status is irrelevant to an `AccessDenied` error caused by a policy requiring encryption during the upload process itself.
- ✗
The IAM user does not have s3:PutObject permission
Why it's wrong here
While lacking the `s3:PutObject` permission would indeed result in an `AccessDenied` error, the context of the question implies a more specific policy violation related to encryption. If the IAM user simply lacked the base `s3:PutObject` permission, the error would be a straightforward authorization failure. However, when a policy explicitly mentions conditions like 'encryption in transit,' the `AccessDenied` error typically arises from failing to meet those specific conditions, even if the user possesses the fundamental `s3:PutObject` action permission.
- ✗
The request signature is expired
Why it's wrong here
An expired request signature, often associated with pre-signed URLs or temporary credentials, would indeed lead to an `AccessDenied` error from Amazon S3. However, S3's error messages are typically quite specific in such cases, often including phrases like 'Request has expired' or 'SignatureDoesNotMatch' along with timestamp details. This distinct error message would clearly indicate an authentication failure due to an invalid or outdated signature, rather than a policy condition violation related to data transport security.
- ✓
The request is not using HTTPS
Why this is correct
Amazon S3 bucket policies can enforce conditions on incoming requests, including requiring secure transport. The `aws:SecureTransport` condition key evaluates to `true` only when a request is made over HTTPS, ensuring data is encrypted in transit. If a bucket policy contains a `Deny` statement for `s3:PutObject` actions where `aws:SecureTransport` is `false`, then any attempt to upload an object using unencrypted HTTP will violate this policy condition, resulting in an `AccessDenied` error because the request did not use HTTPS for encryption in transit.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.