DVA-C02 Security Practice Question
A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption. The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not include the server-side encryption header. Which IAM condition key should be used?
⚠ Common exam trap
Many candidates confuse the condition key for requiring encryption (`s3:x-amz-server-side-encryption`) with the key for specifying a particular KMS key (`s3:x-amz-server-side-encryption-aws-kms-key-id`), leading them to pick option B when the question only asks about enforcing the presence of any server-side encryption header.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption
The `s3:x-amz-server-side-encryption` condition key matches the `x-amz-server-side-encryption` request header, which is used to specify server-side encryption (SSE-S3 or SSE-KMS) for S3 PutObject requests. By denying requests that do not include this header, the policy enforces that all uploads must be encrypted at rest using server-side encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:x-amz-server-side-encryption
Why this is correct
This condition key is used in an S3 bucket policy to evaluate the "x-amz-server-side-encryption" request header. By setting its value to "AES256" or "aws:kms" using a StringEquals operator, you can effectively mandate that all incoming PUT requests must include this header, thereby enforcing server-side encryption for all uploaded objects. This ensures data at rest is protected according to the specified encryption standard.
- ✗
s3:x-amz-server-side-encryption-aws-kms-key-id
Why it's wrong here
While this condition key is crucial for enforcing the use of a *specific* AWS KMS customer master key (CMK) for server-side encryption, it does not, by itself, enforce the *presence* of encryption. Its purpose is to validate the "x-amz-server-side-encryption-aws-kms-key-id" header against a predefined KMS key ARN. Therefore, it cannot be used in isolation to simply require that *any* form of server-side encryption (e.g., S3-managed keys or KMS) is applied to uploads.
- ✗
s3:x-amz-acl
Why it's wrong here
The "s3:x-amz-acl" condition key is designed to control and enforce specific Access Control List (ACL) configurations for objects uploaded to an S3 bucket. It evaluates the "x-amz-acl" request header, allowing bucket policies to restrict uploads based on predefined ACLs like "private" or "bucket-owner-full-control". This key is entirely unrelated to data encryption at rest and therefore cannot be used to mandate server-side encryption for objects.
- ✗
s3:x-amz-storage-class
Why it's wrong here
The "s3:x-amz-storage-class" condition key is utilized within S3 bucket policies to enforce specific storage classes for uploaded objects. It checks the "x-amz-storage-class" request header, enabling administrators to ensure that data is stored in classes like "STANDARD", "INTELLIGENT_TIERING", or "GLACIER" upon upload. This key manages data lifecycle and cost optimization, having no direct bearing on the encryption status of the objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.