ANS-C01 Network Security, Compliance and Governance Practice Question
A company has an S3 bucket that stores sensitive documents. They need to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Additionally, they want to prevent any uploads that do not specify the required KMS key. Which combination of bucket policy and default encryption should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable default encryption on the bucket with SSE-KMS using the required KMS key, and add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with the required key ARN.
Why this is correct
Default encryption ensures objects are encrypted if no header is provided. The bucket policy enforces that uploads must use the specific KMS key.
- ✗
Enable default encryption with SSE-S3, and add a bucket policy that denies s3:PutObject unless the request uses the required KMS key.
Why it's wrong here
SSE-S3 is not KMS, so the policy would conflict. The default encryption must match the policy requirement.
- ✗
Use a bucket policy that requires the kms:Encrypt permission for the required key, but do not enable default encryption.
Why it's wrong here
Without default encryption, objects could be uploaded without encryption if the policy is bypassed. The policy should require the encryption header.
- ✗
Enable default encryption with SSE-KMS using the required key, and rely on IAM policies to enforce encryption, not bucket policies.
Why it's wrong here
IAM policies alone cannot enforce encryption headers on S3 PutObject. A bucket policy with condition keys is necessary.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to encrypt data at rest in an S3 bucket. Which AWS service can manage the encryption keys if the company wants to use server-side encryption with AWS KMS?
easy- A.AWS Certificate Manager (ACM)
- B.AWS CloudHSM
- C.AWS Secrets Manager
- ✓ D.AWS Key Management Service (KMS)
Why D: AWS Key Management Service (KMS) is the service that manages encryption keys for server-side encryption (SSE-KMS). Option D is correct. AWS Certificate Manager (ACM) manages SSL/TLS certificates. AWS CloudHSM provides dedicated hardware security modules but is not required for SSE-KMS. AWS Secrets Manager manages secrets like database credentials.
Variation 2. Refer to the exhibit. A company has an S3 bucket policy that denies PutObject if the object is not encrypted with SSE-KMS. However, uploads are still being allowed without encryption. What is the most likely reason?
medium- A.The bucket policy has a syntax error and is not being enforced.
- B.The IAM user has an explicit Allow that overrides the Deny in the bucket policy.
- ✓ C.The condition key 's3:x-amz-server-side-encryption' is not present in the upload request, so the condition is not evaluated and the Deny is not applied.
- D.The bucket policy must be attached to the bucket in the same region as the request.
Why C: The bucket policy uses a condition key 's3:x-amz-server-side-encryption' to deny uploads that are not encrypted with SSE-KMS. However, if the upload request does not include the 'x-amz-server-side-encryption' header at all, the condition key is not present in the request, so the condition is not evaluated. As a result, the Deny effect is not applied, and the upload is allowed. Option A is incorrect because the policy is valid JSON and would be enforced if the condition were met. Option B is incorrect because an explicit Allow in an IAM policy cannot override a Deny in a bucket policy; the Deny would still apply. Option D is incorrect because bucket policies are evaluated regardless of region as long as the bucket is in the same region as the request's endpoint; the region is not the issue here.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.