DOP-C02 Configuration Management and IaC Practice Question
Exhibit
Refer to the exhibit.
AWS CloudFormation template snippet:
Resources:
MyBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub "${AWS::StackName}-data-${AWS::AccountId}"
VersioningConfiguration:
Status: Enabled
LifecycleConfiguration:
Rules:
- Id: ExpireOldVersions
Status: Enabled
NoncurrentVersionExpirationInDays: 30
MyBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref MyBucket
PolicyDocument:
Statement:
- Effect: Allow
Action: s3:GetObject
Principal: "*"
Resource: !Sub "${MyBucket.Arn}/*"
Condition:
StringEquals:
s3:x-amz-server-side-encryption: "AES256"An organization wants to ensure that all objects stored in the S3 bucket are encrypted at rest using server-side encryption with S3 managed keys (SSE-S3). The bucket policy above is intended to enforce this. However, a user reported that they can still upload unencrypted objects. What is the MOST likely reason?
⚠ Common exam trap
The trap here is that candidates often focus on the condition key or value syntax and overlook the action to which the condition is attached, assuming any encryption-related condition will automatically apply to uploads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The condition is applied to the GetObject action, not the PutObject action.
The bucket policy condition `s3:x-amz-server-side-encryption` is applied to the `s3:GetObject` action instead of `s3:PutObject`. This means the policy only checks encryption headers when reading objects, not when uploading them. To enforce encryption at upload time, the condition must be attached to the `s3:PutObject` action, which is the operation that accepts the `x-amz-server-side-encryption` header.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The condition is applied to the GetObject action, not the PutObject action.
Why this is correct
The bucket policy's condition key is tied to the s3:GetObject action, which only governs read requests. To enforce encryption during uploads, the policy must target s3:PutObject, because that is the action that accepts the x-amz-server-side-encryption header and where a missing encryption header should be denied. Placing the condition on GetObject only denies reading unencrypted objects, leaving uploads allowed without encryption.
- ✗
The bucket policy is not attached to the bucket because of a circular dependency.
Why it's wrong here
A bucket policy attached to the same S3 bucket it references does not create a circular dependency; CloudFormation and normal IAM evaluation can resolve this reference because the policy is a separate resource that depends on the bucket, not vice versa. Circular dependencies in CloudFormation typically occur when a resource's configuration becomes the input of another resource whose own configuration is required earlier inside the same template, which is not the case here. The policy attaches successfully, so the encryption failure is due to the action scope, not a template deployment issue.
- ✗
The bucket policy does not apply to objects uploaded by the root user.
Why it's wrong here
The root user is not automatically exempt from S3 bucket policies; resource-based policies are evaluated for the root user just like any other principal, and an explicit Allow or Deny in the bucket policy controls access. Unless the bucket policy has a global Deny without an exception, root user actions are governed by the same conditions and actions. Here the root user could upload unencrypted objects because the policy's condition is on GetObject, not because the root user bypasses the policy.
- ✗
The condition should use 's3:x-amz-server-side-encryption-aws-kms-key-id' instead.
Why it's wrong here
The condition key s3:x-amz-server-side-encryption-aws-kms-key-id is used to mandate a specific AWS KMS customer master key for SSE-KMS encryption. For SSE-S3 (Amazon S3-managed keys), the correct condition is s3:x-amz-server-side-encryption with value AES256, and this key is only accepted on PutObject calls. Suggesting the KMS key ID condition would be wrong because the environment uses SSE-S3, and even that key would need to be paired with the correct action.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,487 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.