SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

⚠ Common exam trap

Candidates often assume the failure is due to missing KMS key permissions (Option D) or missing IAM permissions (Option B), but the actual cause is the bucket policy condition requiring the encryption header, which is a common S3 security pattern tested on the SAP-C02 exam.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Include the x-amz-server-side-encryption header with value aws:kms in the upload request.

The bucket policy includes a condition that requires the `x-amz-server-side-encryption` header to be set to `aws:kms` for `s3:PutObject` operations. When users assume the cross-account role and upload objects without specifying encryption, the request fails because it does not satisfy this condition. Including the `x-amz-server-side-encryption: aws:kms` header in the upload request explicitly meets the condition, allowing the upload to succeed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Remove the condition from the bucket policy.
Why it's wrong here
Deleting the condition removes the encryption requirement entirely, weakening the bucket's security posture rather than satisfying it. The condition is what blocks unencrypted uploads, so removing it lets data land unencrypted. Editing the policy is tempting as a quick fix, but the correct approach supplies the encryption the condition demands.
✗
Add an IAM policy that allows s3:PutObject to the role.
Why it's wrong here
The role already allows s3:PutObject, so adding another identical permission changes nothing; the failure comes from the bucket policy's encryption condition, not from IAM. Duplicating an existing allow is tempting because IAM denials commonly cause access failures. Here the request must carry the required encryption header to pass the policy.
✓
Include the x-amz-server-side-encryption header with value aws:kms in the upload request.
Why this is correct
The bucket policy likely denies PutObject unless the request specifies SSE-KMS encryption. Adding the x-amz-server-side-encryption header with aws:kms satisfies that condition, so the assumed role's s3:PutObject permission is no longer blocked by the explicit deny.
✗
Grant the role permission to use the KMS key.
Why it's wrong here
The bucket policy's condition requires a specific encryption header, so granting KMS permissions does not satisfy it; the upload still fails the policy check. KMS permissions matter only when objects use SSE-KMS, which is the tempting association here. The scenario needs the request to meet the encryption condition, not key access.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Design for New Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question