DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  "aws:SecureTransport": "false"

  Why this is correct

  This option correctly enforces HTTPS. When used in a Deny statement within an S3 bucket policy, the condition `"aws:SecureTransport": "false"` explicitly blocks any request that is *not* using HTTPS. By denying all unencrypted requests, the policy effectively mandates that all successful interactions with the S3 bucket must utilize HTTPS (TLS) for data in transit, ensuring secure communication.

• ✗

  "aws:SecureTransport": "true"

  Why it's wrong here

  This option is incorrect because using `"aws:SecureTransport": "true"` in a Deny statement would explicitly block all requests that *are* using HTTPS. This would prevent secure access to the S3 bucket, leaving only unencrypted HTTP requests to be potentially allowed, which is the opposite of the desired security posture to enforce secure transport.

• ✗

  "aws:SourceVpc": "true"

  Why it's wrong here

  This option is incorrect because the `aws:SourceVpc` condition key is used to restrict access to an S3 bucket based on the Virtual Private Cloud (VPC) from which the request originates. It evaluates whether a request comes from a specified VPC endpoint. This condition has no bearing on whether the transport layer itself is encrypted (HTTPS) or unencrypted (HTTP), making it irrelevant for enforcing secure transport.

• ✗

  "aws:Referer": "https"

  Why it's wrong here

  This option is incorrect because the `aws:Referer` condition key checks the HTTP `Referer` header, which indicates the URL of the webpage that linked to the requested resource. While it can be used for hotlinking protection or to restrict access to requests originating from specific websites, it does not enforce encryption in transit for the current request. The presence of "https" in the Referer header does not guarantee the current connection is secure.