DVA-C02 Security Practice Question
A developer wants to ensure that an S3 bucket only allows HTTPS requests. What S3 bucket policy condition should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aws:SecureTransport
The aws:SecureTransport condition checks whether the request was sent using SSL/TLS, effectively enabling HTTPS-only access. Option A is incorrect because aws:CurrentTime is used to allow or deny access based on the time of the request. Option B is incorrect because aws:MultiFactorAuthPresent checks if the requester authenticated with multi-factor authentication. Option C is incorrect because aws:SourceIp is used to restrict requests based on the source IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aws:CurrentTime
Why it's wrong here
The aws:CurrentTime condition key is used to restrict access based on the date and time a request is made. It allows administrators to define policies that are effective only during specific time windows, or to set expiration dates for temporary access. This key is entirely unrelated to the transport protocol (HTTP vs. HTTPS) used for the request, making it unsuitable for enforcing secure transport.
- ✗
aws:MultiFactorAuthPresent
Why it's wrong here
The aws:MultiFactorAuthPresent condition key evaluates whether the principal making the request has authenticated using multi-factor authentication (MFA). This is a security control focused on strengthening identity verification for API calls or console access. While crucial for identity security, it has no bearing on whether the data transfer itself is encrypted in transit via HTTPS, which is the requirement here.
- ✗
aws:SourceIp
Why it's wrong here
The aws:SourceIp condition key is utilized to restrict access to an S3 bucket based on the IP address or range from which the request originates. This is effective for creating network-based boundaries, ensuring that only requests from trusted networks can interact with the bucket. However, this condition key does not enforce the use of HTTPS for data transmission, as it only checks the source IP, not the encryption status of the connection.
- ✓
aws:SecureTransport
Why this is correct
The aws:SecureTransport condition key specifically evaluates whether the incoming request to an S3 bucket was made using HTTPS (TLS/SSL). When set to "true" in a bucket policy, it mandates that all interactions with the bucket must occur over an encrypted connection, effectively preventing unencrypted HTTP requests. This directly addresses the requirement to ensure that the S3 bucket only allows secure, encrypted data transfer.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.