DVA-C02 Security Practice Question
A developer wants to encrypt data in transit between an application and an S3 bucket. Which option achieves this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use HTTPS when making requests to S3.
HTTPS encrypts data in transit between the application and S3, ensuring confidentiality during transmission. Option A is incorrect because SSE-S3 encrypts data at rest, not in transit. Option B is incorrect because IAM policies control access permissions, not encryption. Option D is incorrect because encrypting data with AWS KMS before upload addresses at-rest encryption, but without HTTPS, data is still transmitted in plaintext.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
Server-side encryption with S3-managed keys (SSE-S3) encrypts the object data at rest once it has already arrived on S3's storage servers, using AES-256; it does nothing to protect the bytes while they travel across the network between the client and S3, so it does not satisfy an in-transit encryption requirement.
- ✗
Configure an IAM policy to require encryption.
Why it's wrong here
An IAM policy can enforce a condition such as aws:SecureTransport to deny requests that do not use HTTPS, but the policy itself performs no cryptographic operation; it is an access-control mechanism that can require encryption be used, not a mechanism that actually encrypts the data in transit.
- ✓
Use HTTPS when making requests to S3.
Why this is correct
Making requests to the S3 API endpoint over HTTPS wraps every request and response in TLS, encrypting the data as it moves across the network between the application and S3's servers, which is precisely what in-transit encryption means and is enabled by default on all S3 endpoints.
- ✗
Use AWS KMS to encrypt the data before upload.
Why it's wrong here
Encrypting the data client-side with an AWS KMS data key before uploading protects the object's confidentiality regardless of the transport used, but this is a form of client-side or at-rest protection applied to the payload itself, not an in-transit protection of the network channel the request travels over.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.