DVA-C02 Security Practice Question
A company has an S3 bucket that stores sensitive data. They want to ensure that any object uploaded to the bucket is automatically encrypted with server-side encryption using AWS KMS (SSE-KMS). They also want to deny any uploads that do not specify the correct encryption. Which bucket policy condition should be used to enforce this requirement?
⚠ Common exam trap
Candidates often confuse the condition for specifying a particular KMS key ARN (Option C) with the condition for simply requiring SSE-KMS encryption, leading them to pick an overly restrictive policy that would break uploads using the default KMS key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption equals aws:kms
The condition `s3:x-amz-server-side-encryption equals aws:kms` enforces that any PUT request to the S3 bucket must include the `x-amz-server-side-encryption` header set to `aws:kms`, which triggers SSE-KMS encryption. This policy condition ensures that objects uploaded without specifying SSE-KMS are denied, meeting the requirement to automatically encrypt all uploaded objects with AWS KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:x-amz-server-side-encryption equals aws:kms
Why this is correct
This condition key directly inspects the `x-amz-server-side-encryption` request header, which clients must include to specify the desired server-side encryption method. By setting `aws:kms` as the required value, a bucket policy with a Deny effect ensures that any object uploaded to the S3 bucket *must* explicitly request Server-Side Encryption with AWS Key Management Service (SSE-KMS). This effectively enforces the use of KMS-managed keys for sensitive data at rest, preventing uploads that do not comply with this encryption standard.
- ✗
s3:x-amz-server-side-encryption equals AES256
Why it's wrong here
While `s3:x-amz-server-side-encryption equals AES256` does enforce server-side encryption, it specifically mandates Server-Side Encryption with S3-managed keys (SSE-S3). This method utilizes Amazon S3's own service-managed encryption keys, which are not directly managed by the customer through AWS KMS. Therefore, this condition fails to meet the requirement of using AWS KMS for encryption, as the question implies a need for greater customer control over key management, which SSE-S3 does not provide.
- ✗
s3:x-amz-server-side-encryption-aws-kms-key-id equals a specific key ARN
Why it's wrong here
While this can enforce a specific CMK, it does not enforce that SSE-KMS is used at all. An upload using SSE-S3 would not include this header and would not be rejected by this condition alone.
- ✗
aws:SecureTransport equals true
Why it's wrong here
The `aws:SecureTransport equals true` condition in an S3 bucket policy ensures that all requests to the bucket are made exclusively over HTTPS, thereby encrypting data *in transit* between the client and S3. While critical for protecting data during transmission, this condition has no bearing on how data is encrypted *at rest* once it is stored within the S3 bucket. It does not enforce any specific server-side encryption method like SSE-KMS, SSE-S3, or SSE-C, and thus does not address the requirement for KMS-based encryption of stored objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.