SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole"
      },
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

⚠ Common exam trap

Candidates often assume the failure is due to missing KMS key permissions (Option D) or missing IAM permissions (Option B), but the actual cause is the bucket policy condition requiring the encryption header, which is a common S3 security pattern tested on the SAP-C02 exam.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Include the x-amz-server-side-encryption header with value aws:kms in the upload request.

The bucket policy includes a condition that requires the `x-amz-server-side-encryption` header to be set to `aws:kms` for `s3:PutObject` operations. When users assume the cross-account role and upload objects without specifying encryption, the request fails because it does not satisfy this condition. Including the `x-amz-server-side-encryption: aws:kms` header in the upload request explicitly meets the condition, allowing the upload to succeed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Remove the condition from the bucket policy.
Why it's wrong here
The condition is required for compliance.
✗
Add an IAM policy that allows s3:PutObject to the role.
Why it's wrong here
The role already has the permission.
✓
Include the x-amz-server-side-encryption header with value aws:kms in the upload request.
Why this is correct
The condition requires that header.
✗
Grant the role permission to use the KMS key.
Why it's wrong here
The condition requires encryption header, not KMS key permission.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Design for New Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question