DOP-C02 Security and Compliance Practice Question
A company is migrating to AWS and has a requirement to encrypt all data at rest and in transit. They are using AWS KMS with Customer Master Keys (CMKs) for encryption. The DevOps engineer has set up an S3 bucket with default encryption using SSE-KMS. The bucket policy allows access only to a specific IAM role. The engineer also enabled S3 bucket versioning and MFA Delete. However, when the engineer tries to download an object using the AWS CLI with the IAM role, the command fails with 'AccessDenied'. The IAM role has the following permissions: s3:GetObject, s3:ListBucket, kms:Decrypt, kms:DescribeKey. What is the most likely missing permission?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the IAM role permission to decrypt using the key.
The error 'AccessDenied' when downloading an object encrypted with SSE-KMS indicates that the IAM role lacks permission to use the KMS key for decryption. Even though the IAM role has kms:Decrypt, the KMS key policy must explicitly grant the role permission to decrypt using that key. Without this key policy grant, the role's IAM permissions are insufficient. Option D is correct because the key policy is the missing piece. Option A is incorrect because kms:GenerateDataKey is needed for uploading, not downloading. Option B is incorrect as kms:Encrypt is also for writing. Option C is incorrect because kms:CreateGrant is not required for this operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IAM role is missing kms:GenerateDataKey permission.
Why it's wrong here
The kms:GenerateDataKey permission is used when creating a new data key to encrypt data (envelope encryption), typically during uploads or encryption operations. Downloading and decrypting data does not invoke GenerateDataKey; it invokes the kms:Decrypt API to decrypt the data key. Therefore, the absence of GenerateDataKey would not prevent a successful download, making this an incorrect explanation.
- ✗
The IAM role is missing kms:Encrypt permission.
Why it's wrong here
kms:Encrypt is the permission required to encrypt plaintext directly with a KMS key, not to decrypt ciphertext. During a download, the client retrieves the encrypted data key and calls the kms:Decrypt API to decrypt it. Since kms:Encrypt is not part of the read/decryption path, an IAM role missing only this permission would still be able to download the object successfully.
- ✗
The IAM role is missing kms:CreateGrant permission.
Why it's wrong here
kms:CreateGrant is used to create a grant, which is an alternative mechanism to allow another principal to use a KMS key without modifying the key policy. Grants are not required for an IAM role to decrypt data normally—the role simply needs kms:Decrypt permission in its IAM policy and a key policy that allows it. Missing CreateGrant has no effect on a standard download workflow.
- ✓
The KMS key policy does not grant the IAM role permission to decrypt using the key.
Why this is correct
For an IAM role to decrypt an object using a customer managed key, the KMS key policy must explicitly include the role (or an account principal with delegation) in a statement that allows kms:Decrypt. Even if the IAM role's permissions policy grants kms:Decrypt, KMS requires both the IAM policy and the key policy to authorize the action. If the key policy only allows a different principal or restricts access to specific roles, the decryption fails—this is the most direct cause of the error.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.