SAA-C03 Design Secure Architectures Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [{
"Action": "s3:*",
"Effect": "Deny",
"Resource": "arn:aws:s3:::corporate-data/*",
"Condition": {"Bool": {"aws:SecureTransport": "false"}},
"Principal": "*"
}]
}Refer to the exhibit. A security audit identifies that data is being transmitted to an S3 bucket named 'corporate-data' without encryption in transit. Which behavior does this bucket policy enforce to address this concern?
⚠ Common exam trap
SAA-C03 often tests the confusion between encryption in transit (HTTPS) and encryption at rest (SSE), tempting candidates to pick an option about server-side encryption when the question specifies 'in transit'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It denies any S3 action if the request does not use an encrypted connection (HTTPS).
The bucket policy denies any S3 action if the request does not use an encrypted connection (HTTPS). This is enforced by a condition like aws:SecureTransport: false, which blocks HTTP requests. This directly addresses the concern of data in transit being unencrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It denies any S3 action if the request does not use an encrypted connection (HTTPS).
Why this is correct
The policy uses a Deny effect combined with a false condition for secure transport, which means any request not using HTTPS is blocked. This is a preventative control that ensures data is encrypted while moving between the client and S3, protecting it from interception by unauthorized parties.
- ✗
It ensures that all objects stored in the bucket are encrypted using AES-256 server-side encryption.
Why it's wrong here
Server-side encryption (SSE-S3 or SSE-KMS) protects data at rest within the S3 bucket but does not govern how data is transmitted. This policy specifically targets the transport layer (OSI Layer 4/7) rather than the storage layer, so it does not ensure that the data is encrypted once stored.
- ✗
It logs all access attempts to the bucket to identify users who are not using SSL.
Why it's wrong here
Bucket policies apply to all principals when the Principal field is set to a wildcard, but they do not automatically enable logging. CloudTrail or S3 server access logs must be configured separately to track access requests, whereas this policy is designed to enforce security protocols for incoming traffic.
- ✗
It automatically redirects all HTTP requests to HTTPS for the specified S3 bucket.
Why it's wrong here
Unlike some web servers or CloudFront, S3 bucket policies cannot perform a protocol redirect from HTTP to HTTPS. Instead, the policy simply denies the insecure request, forcing the client to resubmit the request using the secure HTTPS protocol to gain access to the bucket's resources.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.