DOP-C02 Resilient Cloud Solutions Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}
```Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?
⚠ Common exam trap
Many exam-takers assume an Allow statement with a condition implicitly denies requests that don't meet the condition, but AWS IAM requires an explicit Deny to block non-compliant requests, and the absence of that Deny is the root cause of the enforcement failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy only allows the action but does not deny actions that do not meet the condition.
The IAM policy only allows the s3:PutObject action when the encryption condition is met, but it does not include an explicit Deny statement to block uploads that do not satisfy the condition. In IAM, an Allow statement with a condition does not automatically deny requests that fail the condition; it simply does not apply the Allow. If there is another policy (e.g., a bucket policy or an identity-based policy) that grants s3:PutObject without the encryption condition, or if the default S3 behavior permits unencrypted uploads (since S3 does not require encryption by default), then unencrypted uploads can still succeed. To enforce encryption, you must add a Deny statement with a condition like `StringNotEquals` on `s3:x-amz-server-side-encryption` to explicitly reject requests that lack the required encryption header.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy uses StringEquals instead of StringNotEquals.
Why it's wrong here
Using StringEquals is correct here because the condition should evaluate to true only when the request's condition key matches the exact required value (e.g., the encryption header). With StringNotEquals, the Allow statement would match only when the condition key is present and not equal to that value, which would exclude properly encrypted requests while permitting non-compliant ones. A missing condition key also makes StringNotEquals evaluate false, further narrowing the grant. Therefore this is not a flaw.
- ✓
The policy only allows the action but does not deny actions that do not meet the condition.
Why this is correct
This is the core problem: IAM is default-deny, so this Allow statement only grants the upload when the condition is met; it does nothing to block uploads that fail the condition if another policy grants them. To enforce encryption, you must include an explicit Deny for s3:PutObject without the required encryption condition, because Deny always overrides Allow. Merely adding a condition to an Allow does not constrain other permissions.
- ✗
The resource ARN is incorrect; it should be the bucket ARN.
Why it's wrong here
The resource ARN in the policy is correctly specified as arn:aws:s3:::bucket/* because s3:PutObject acts on an individual object, not the bucket itself. Using the bucket ARN would only match bucket-level operations such as s3:ListBucket, and it would not grant the upload. The notation with '/*' is the standard way to target all objects within the bucket, so this option is wrong.
- ✗
The action should be s3:PutEncryptedObject instead of s3:PutObject.
Why it's wrong here
There is no IAM action named s3:PutEncryptedObject in the S3 service; uploading an object is always governed by s3:PutObject. Encryption requirements are enforced by attaching conditions like s3:x-amz-server-side-encryption to that action, not by choosing a separate action. Thus the proposed action is invalid, and the existing s3:PutObject is exactly what belongs in the policy.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?
medium- A.The resource ARN is incorrect; it should be the bucket ARN.
- ✓ B.The policy only allows the action but does not deny actions that do not meet the condition.
- C.The action should be s3:PutEncryptedObject instead of s3:PutObject.
- D.The policy uses StringEquals instead of StringNotEquals.
Why B: The IAM policy shown only allows the s3:PutObject action when the encryption condition is met, but it does not include a Deny statement to explicitly block uploads that do not satisfy the condition. In AWS IAM, an Allow statement alone does not prevent actions that fail the condition; it simply grants permission when the condition is true. Without a corresponding Deny, users with other permissions (e.g., from a broader policy) can still upload objects without encryption, as the Allow does not override other effective allows.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.