MLS-C01 Data Engineering Practice Question
A data engineering team is designing a data lake on Amazon S3. They need to enforce encryption at rest for all data stored in the bucket. The security policy requires that the encryption keys be managed by the organization using AWS Key Management Service (KMS), and that the bucket must deny uploads of unencrypted objects. Which bucket policy should be applied?
⚠ Common exam trap
It's easy for candidates to confuse 'default encryption' (which silently encrypts objects but does not deny unencrypted uploads) with a bucket policy that actively denies requests without the required encryption headers, leading them to choose Option D instead of the policy-based enforcement in Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A bucket policy that denies PutObject unless the request includes the 'x-amz-server-side-encryption-aws-kms-key-id' header matching the desired KMS key ID
The security policy requires that encryption keys be managed by the organization using AWS KMS, and that unencrypted uploads be denied. A bucket policy that denies PutObject unless the request includes the 'x-amz-server-side-encryption-aws-kms-key-id' header matching the desired KMS key ID enforces both conditions: it ensures server-side encryption with a customer-managed KMS key (SSE-KMS) and blocks any upload that does not specify the exact key ID, thereby preventing unencrypted objects or objects encrypted with other keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A bucket policy that denies PutObject unless the request includes the 'x-amz-server-side-encryption' header with value 'AES256'
Why it's wrong here
This enforces SSE-S3, not KMS.
- ✗
A bucket policy that denies PutObject if the 'x-amz-server-side-encryption' header is not present
Why it's wrong here
This would allow any encryption (including SSE-S3), not specifically KMS.
- ✓
A bucket policy that denies PutObject unless the request includes the 'x-amz-server-side-encryption-aws-kms-key-id' header matching the desired KMS key ID
Why this is correct
This enforces the use of a specific KMS key.
- ✗
Enable default encryption on the bucket with AWS-KMS
Why it's wrong here
Default encryption does not prevent uploads without encryption; it only encrypts objects that are not already encrypted.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.