DOP-C02 Security and Compliance Practice Question
A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using customer-managed KMS keys. Additionally, any attempt to upload an unencrypted object must be denied. Which S3 bucket policy should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms
The condition 's3:x-amz-server-side-encryption':'aws:kms' in a Deny statement ensures that only requests with SSE-KMS encryption are allowed, blocking unencrypted uploads or uploads with other encryption types. Option A is wrong because 'true' is not a valid encryption type; the correct value is 'aws:kms'. Option B is wrong because it allows SSE-S3 (AES256), not KMS encryption. Option C is wrong because it checks a KMS encryption context rather than the encryption header, and it does not deny unencrypted uploads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: true
Why it's wrong here
This policy uses the condition key s3:x-amz-server-side-encryption with a boolean value 'true'. However, this key expects a valid server-side encryption algorithm identifier such as 'AES256' or 'aws:kms', not a boolean. The condition will never evaluate to true for any real PutObject request, causing the explicit Deny to block all uploads regardless of encryption header. Even if it did match, it would not specifically require KMS encryption, leaving the policy ineffective for the stated requirement.
- ✗
Allow s3:PutObject with condition s3:x-amz-server-side-encryption: AES256
Why it's wrong here
This statement allows PutObject only when the request specifies SSE-S3 via the header x-amz-server-side-encryption: AES256. While this does enforce encryption at rest with Amazon S3 managed keys, it does not require KMS-managed keys as the scenario demands. Moreover, because there is no explicit Deny, any upload that does not match this condition may still be permitted by other bucket or IAM policies, so unencrypted objects are not actually blocked. The use of Allow with a condition is not sufficient to deny non-conforming requests.
- ✗
Allow s3:PutObject with condition kms:EncryptionContext: department:finance
Why it's wrong here
This condition restricts access to PutObject calls that use SSE-KMS with a specific encryption context containing department=finance, but it does not require any form of encryption on the request. If an upload does not use KMS or omits the encryption context, the condition fails and the Allow is not granted; however, without a matching Deny statement, that upload could still succeed through another policy. Encryption context is an additional authentication factor for KMS keys, not a replacement for enforcing server-side encryption. Therefore, this policy neither enforces encryption nor denies unencrypted writes.
- ✓
Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms
Why this is correct
This explicit Deny is the correct approach because it denies any PutObject that does not include the x-amz-server-side-encryption header with the value 'aws:kms'. The value 'aws:kms' is the algorithm identifier for SSE-KMS, ensuring all uploaded objects are encrypted with a KMS-managed key. Because it is an explicit deny, even if another policy allows an unencrypted upload, this deny overrides it. This is the standard pattern for enforcing KMS encryption across an S3 bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an S3 bucket with sensitive data. The security team requires that all data uploaded to the bucket be automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). How can this be enforced?
easy- A.Enable default encryption on the S3 bucket with SSE-KMS.
- ✓ B.Use an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.
- C.Enable AWS CloudTrail to monitor uploads and alert on unencrypted objects.
- D.Create an IAM policy that requires all S3 operations to use SSE-KMS.
Why B: A bucket policy that explicitly denies PutObject requests lacking the x-amz-server-side-encryption header (or with a value other than aws:kms) provides a hard enforcement mechanism. Unlike default encryption, which only applies when the request does not specify an encryption header, this policy rejects any upload that does not affirmatively request SSE-KMS. This ensures that all objects are encrypted with AWS KMS managed keys as required by the security team.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.