DOP-C02 Incident and Event Response Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}
```Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The upload fails with an Access Denied error.
The upload fails with an Access Denied error because the IAM policy attached to the user includes a condition that requires the request to include the `x-amz-server-side-encryption` header with a value of `AES256`. Since the user attempts to upload without specifying any server-side encryption, the request does not satisfy the condition and is denied. Option A is incorrect because the policy denies unencrypted uploads. Option B is incorrect because the user did not request SSE-S3. Option C is incorrect because automatic encryption does not override the IAM policy condition; the policy explicitly requires the encryption header to be present in the request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The upload succeeds without encryption.
Why it's wrong here
The upload fails because the IAM policy explicitly denies s3:PutObject when the encryption header is missing. The condition key s3:x-amz-server-side-encryption is checked against the request; if it is null, the Deny statement matches and the request is rejected. Thus, attempting an unencrypted upload will always receive an Access Denied error from S3.
- ✗
The upload succeeds with SSE-S3 encryption.
Why it's wrong here
Simply enabling SSE-S3 on the bucket does not satisfy the IAM condition; the policy requires the x-amz-server-side-encryption: AES256 header to be present in the PutObject call itself. Even if the object would ultimately be encrypted with SSE-S3 due to bucket default encryption, the request lacks the explicit header at authorization time, so the deny condition triggers. The user must explicitly set the encryption header in the upload request to pass the policy check.
- ✗
The upload succeeds and is automatically encrypted with SSE-S3.
Why it's wrong here
Automatic encryption via a bucket's default encryption policy cannot override an IAM deny condition. When the user uploads without specifying an encryption header, S3 may apply bucket-level default encryption after authorization, but the IAM policy is evaluated first and rejects the request based on the missing header. Since the condition is a Deny, it takes precedence over any bucket setting, so the upload fails with Access Denied before encryption can be applied.
- ✓
The upload fails with an Access Denied error.
Why this is correct
The correct behavior is that the upload request is denied at the IAM authorization layer. The policy statement uses a Deny effect with a condition like "Null": {"s3:x-amz-server-side-encryption": "true"} to require the encryption header. As the request does not include the header, the condition matches, and S3 returns AccessDenied. This is a common pattern for enforcing server-side encryption on all uploads.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.