DOP-C02 SSE-KMS Practice Question
A company wants to encrypt data at rest in Amazon S3 using server-side encryption with AWS Key Management Service (SSE-KMS) and enforce that all new objects are encrypted. Which bucket policy statement should be added?
⚠ Common exam trap
Candidates might confuse the condition keys or the string comparison operators. `s3:x-amz-server-side-encryption` checks the encryption algorithm (e.g., AES256 or aws:kms), while `s3:x-amz-server-side-encryption-aws-kms-key-id` checks the specific KMS key ID. Also, `StringNotEquals` is used to deny if a required condition is not met, whereas `StringEquals` with deny can accidentally block valid requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}
Option C uses the valid condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` to deny `s3:PutObject` if the request does not include the specified KMS key ID. This enforces that all new objects are encrypted with that specific KMS key. Option A is incorrect because `s3:ServerSideEncryption` is not a valid condition key for S3. Option B is incorrect because it uses `StringEquals` instead of `StringNotEquals`, causing it to deny requests that include the specified KMS key, which prevents the use of SSE-KMS. Option D is incorrect because it uses `s3:x-amz-server-side-encryption` with value `AES256`, which enforces SSE-S3, not SSE-KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:ServerSideEncryption":"awskms"}}}
Why it's wrong here
This policy is ineffective because `s3:ServerSideEncryption` is not a recognized condition key in Amazon S3. The correct key for the encryption header is `s3:x-amz-server-side-encryption`. Since the condition key is invalid, the Deny rule never evaluates, allowing objects to be uploaded without any encryption enforcement.
- ✗
{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}
Why it's wrong here
This policy denies exactly the uploads that should be allowed. Because the condition uses `StringEquals` with the target KMS key ID, the Deny applies when the request's encryption key matches that ARN, blocking all legitimate uploads encrypted with that key while not affecting requests that use a different key or no key at all.
- ✓
{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}
Why this is correct
Using `StringNotEquals` on the KMS key ID correctly denies every `PutObject` request whose encryption key is not the specified ARN. This ensures that only objects encrypted with the designated customer-managed KMS key can be written to the bucket, enforcing SSE-KMS with that exact key.
- ✗
{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}
Why it's wrong here
Although `s3:x-amz-server-side-encryption` is a valid condition key, the value `AES256` represents SSE-S3 with Amazon-managed keys, not SSE-KMS. A `StringNotEquals` Deny with this value would block uploads that use `aws:kms` (the SSE-KMS header value) while allowing AES256-encrypted objects, thus failing to enforce the required customer-managed KMS key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.