DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The encrypted file is corrupted.

  Why it's wrong here

  A corrupted ciphertext blob would cause the KMS Decrypt API to fail with an InvalidCiphertextException, since KMS validates the integrity of the ciphertext structure before attempting decryption — this produces a clearly different error message than an authorization failure and does not match the described symptom.

• ✗

  The CLI cannot read the file.

  Why it's wrong here

  If the CLI genuinely could not read the local file, the failure would occur at the file-system level before any AWS API call was even made, typically surfacing as a local 'No such file or directory' or permission-denied OS error rather than an AWS service-side error response, so this does not align with an error returned from the KMS decrypt call itself.

• ✓

  The IAM user lacks kms:Decrypt permission on the key.

  Why this is correct

  An AccessDeniedException from KMS Decrypt specifically means the calling principal's IAM policy or the KMS key's resource policy (key policy) does not grant kms:Decrypt on that key — KMS enforces both the identity-based policy and the key policy, and either one missing the grant results in exactly this authorization failure.

• ✗

  The KMS key ID is incorrect.

  Why it's wrong here

  An incorrect or non-existent key ID triggers a NotFoundException from KMS, since the service cannot locate a key matching the identifier before it would even evaluate permissions — this is a distinct error type from an access-denied response and points to a different root cause than what the scenario describes.

Go deeper

Related to this question