Question 1,522 of 724
DVA-C02 Security Practice Question
A company has multiple AWS accounts managed under AWS Organizations. The security team requires that all Amazon S3 buckets with bucket names containing 'logs' must be encrypted with a specific KMS key (key ID: alias/logs-key) at rest. A developer must enforce this using an SCP (Service Control Policy). Which SCP effect and condition key should be used to deny any PutObject request that does not use the required KMS key?
⚠ Common exam trap
A common mix-up: candidates confuse `s3:x-amz-server-side-encryption` (which only checks encryption type) with `s3:x-amz-server-side-encryption-aws-kms-key-id` (which checks the specific KMS key), leading them to choose Option B instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id
SCPs use a Deny effect to block non-compliant requests. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` ensures that any PutObject request that does not specify the exact KMS key alias/logs-key is denied. This enforces encryption with the required key for all S3 buckets containing 'logs' in their name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id
Why this is correct
This SCP will deny any PutObject request that specifies a KMS key that is not the required key. The StringNotEquals condition ensures that if the request does not use the specific key ID, the request is denied. This is the standard way to enforce encryption with a specific KMS key using SCPs.
- ✗
Deny effect with a Condition: StringEquals on s3:x-amz-server-side-encryption
Why it's wrong here
The condition key s3:x-amz-server-side-encryption only checks whether encryption is requested (e.g., AES256 or aws:kms), but does not specify which KMS key. Using StringEquals with this key would deny requests that do not use the encryption header, but it would not enforce the use of a specific KMS key.
- ✗
Allow effect with a Condition: StringEquals on kms:RequestTag/key-id
Why it's wrong here
Service Control Policies (SCPs) primarily function as guardrails, setting maximum permissions. While they can include an Allow effect, it's generally not used to grant permissions but rather to define a baseline or override a higher-level Deny. For enforcing a specific configuration like KMS key usage, a Deny is the correct and robust approach to prevent non-compliant actions. Furthermore, the kms:RequestTag/key-id condition key is designed for KMS API calls to check tags on the request itself, not for S3 PutObject operations, which use S3-specific encryption headers. This SCP would therefore be ineffective and misconfigured for the stated goal.
- ✗
Deny effect with a Condition: IpAddress on aws:SourceIp
Why it's wrong here
The aws:SourceIp condition key is used to restrict or allow access to AWS resources based on the originating IP address of the request. While this is a valuable control for network-based access, it has no bearing on the server-side encryption method or the specific KMS key used for S3 objects. Applying this condition would only control *who* can upload objects based on their network location, completely failing to address the requirement of enforcing a specific KMS key for encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.