DOP-C02 Security and Compliance Practice Question
A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.
Options B and E are correct. To restrict KMS key usage to within the VPC, you first create a VPC endpoint for AWS KMS (Option E) to allow private connectivity. Then, you modify the KMS key policy to include a condition that requires the request to originate from that VPC endpoint, using the kms:ViaService condition key (Option B). Option A is wrong because security groups do not apply to KMS keys; they are used for EC2 instances and network interfaces. Option C is wrong because S3 bucket policies cannot restrict which KMS key is used for encryption; they can only restrict S3 actions. Option D is wrong because service control policies (SCPs) apply at the organizational level and cannot restrict KMS key usage to a specific VPC; key policies are the correct mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a security group to the KMS key.
Why it's wrong here
Security groups are for EC2 instances, not for KMS keys.
- ✓
Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.
Why this is correct
This condition restricts use of the key to requests coming through the VPC endpoint.
- ✗
Configure the S3 bucket policy to allow only requests from the VPC.
Why it's wrong here
Bucket policy controls access to S3, not to the KMS key.
- ✗
Create a service control policy (SCP) that denies KMS operations from outside the VPC.
Why it's wrong here
SCPs apply to accounts, not to specific KMS keys.
- ✓
Create a VPC endpoint for AWS KMS.
Why this is correct
A VPC endpoint allows private access to KMS without traversing the internet.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.