ANS-C01 Network Security, Compliance and Governance Practice Question
A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption-aws-kms-key-id
The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to require that objects uploaded to the bucket are encrypted with a specific KMS key, thus enforcing SSE-KMS. Option B (s3:x-amz-server-side-encryption) only checks for any server-side encryption, not a specific key. Option C (kms:ViaService) is a condition key for KMS key policies, not S3 bucket policies. Option D (kms:EncryptionContext) is used in KMS policies to restrict encryption contexts, not applicable to S3 bucket policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:x-amz-server-side-encryption-aws-kms-key-id
Why this is correct
This condition key allows you to enforce that a specific KMS key is used for encryption.
- ✗
s3:x-amz-server-side-encryption
Why it's wrong here
This condition checks if encryption is enabled but does not specify the key type.
- ✗
kms:ViaService
Why it's wrong here
This is used in KMS key policies to restrict usage to specific AWS services.
- ✗
kms:EncryptionContext
Why it's wrong here
This is not a valid S3 condition key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?
easy- A.kms:ViaService
- B.s3:x-amz-server-side-encryption
- C.aws:SourceVpce
- ✓ D.s3:x-amz-server-side-encryption-aws-kms-key-id
Why D: S3:x-amz-server-side-encryption-aws-kms-key-id. This condition key in an S3 bucket policy allows you to enforce that objects must be encrypted with a specific AWS KMS key when the SSE-KMS header is used. Option A (kms:ViaService) is a condition key used in KMS key policies, not in S3 bucket policies; it controls which AWS services can use the KMS key. Option B (s3:x-amz-server-side-encryption) checks the encryption header but cannot enforce a specific KMS key ID—it only checks for the value 'aws:kms' or 'AES256', but not the key ID. Option C (aws:SourceVpce) is used to restrict access to a specific VPC endpoint, not encryption settings. Therefore, only D provides the granularity to require a specific KMS key ID for SSE-KMS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.