DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Whether the object is encrypted

  Why it's wrong here

  The `aws s3api get-object-attributes` command is designed to retrieve specific metadata about an S3 object, such as its size, ETag, and storage class. However, its standard output does not include explicit information regarding the object's encryption status, such as whether it uses SSE-S3, SSE-KMS, or SSE-C, or the specific KMS key ID. To determine encryption details, one would typically need to inspect the object's properties via the S3 console, use the `head-object` API call, or examine bucket policies.

• ✓

  The size and ETag of an object in S3

  Why this is correct

  The `aws s3api get-object-attributes` command is specifically engineered to efficiently retrieve various attributes of an S3 object without requiring the download of the object's content. Among the key pieces of metadata it returns are the `ObjectSize`, which provides the total size of the object in bytes, and the `ETag`, an entity tag that serves as a hash of the object's content. These attributes are crucial for integrity checks, conditional requests, and managing storage consumption within S3.

• ✗

  The version ID of the object

  Why it's wrong here

  While Amazon S3 supports object versioning, the `get-object-attributes` command does not inherently return the `VersionId` of the object as part of its standard output attributes. The command focuses on properties of the object itself, or a specific version if one is requested in the input. To identify the `VersionId` for a particular object or to list all versions, alternative API calls such as `list-object-versions` or `head-object` (when a specific version is targeted) are typically used.

• ✗

  Whether the user has permissions to access the object

  Why it's wrong here

  The `get-object-attributes` command's purpose is to retrieve metadata about an S3 object, not to explicitly test or report on the caller's permissions. If the user executing the command lacks the necessary `s3:GetObjectAttributes` permissions for the specified object, the API call will fail with an access denied error (e.g., HTTP 403 Forbidden). Therefore, a successful execution of the command implicitly confirms the user has permissions, but the command's output itself does not contain a field indicating permission status.

Go deeper

Related to this question