DVA-C02 Security Practice Question
An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?
⚠ Common exam trap
It's easy for candidates to assume a bucket policy granting s3:GetObject is sufficient for all objects, forgetting that SSE-KMS adds a separate authorization layer via KMS key policies that must explicitly allow the decrypt operation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The caller must be allowed to use the KMS key for decrypt operations
When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The caller must be allowed to use the KMS key for decrypt operations
Why this is correct
When an S3 object is encrypted using Server-Side Encryption with AWS KMS (SSE-KMS), the requesting principal requires explicit kms:Decrypt permissions on the associated KMS key. Even if the S3 bucket policy grants s3:GetObject to another account, the cross-account caller cannot retrieve the object's plaintext data without the necessary KMS key usage permissions. This dual authorization ensures robust data protection by separating storage access from encryption key access.
- ✗
The caller must own the destination VPC
Why it's wrong here
Ownership of a destination VPC is not a prerequisite for performing an s3:GetObject operation. S3 is a global service accessible over the internet, and while VPC endpoints can provide private connectivity, the fundamental authorization for GetObject relies on IAM policies, bucket policies, and object ACLs, not network infrastructure ownership. The caller's network environment, whether a VPC or on-premises, does not dictate their permission to retrieve an object.
- ✗
The bucket must enable static website hosting
Why it's wrong here
Enabling static website hosting on an S3 bucket configures it to serve web content via HTTP/HTTPS endpoints, supporting features like index documents and custom error pages. However, this feature is entirely distinct from the s3:GetObject API operation, which retrieves objects directly. Static website hosting does not govern or influence the permissions required for programmatic GetObject calls, especially for cross-account access.
- ✗
The object key must end with .kms
Why it's wrong here
The naming convention of an S3 object key, such as ending with .kms, has no bearing on whether the object is encrypted with AWS KMS or on the permissions required to access it. Object encryption is determined by metadata set during the upload process (e.g., x-amz-server-side-encryption: aws:kms), not by the object's filename or extension. Filename extensions are purely descriptive and do not enforce encryption mechanisms or access controls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.