SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?
⚠ Common exam trap
Watch out — candidates often assume the error is due to network or access policies (Options A or B) rather than recognizing that KMS key policies must explicitly grant encryption permissions to intermediate services like Firehose, which is a subtle but critical requirement for encrypted log pipelines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.
The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CloudWatch Logs subscription filter does not have permissions to write to Firehose.
Why it's wrong here
The subscription filter uses a service-linked role; if it worked before, it's not the issue.
- ✗
The OpenSearch cluster's access policy denies write access from the Firehose stream.
Why it's wrong here
The error is 'AccessDenied' during delivery, not at the cluster level.
- ✓
The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.
Why this is correct
Firehose needs kms:Encrypt and kms:Decrypt permissions on the key.
- ✗
The Firehose delivery stream does not have a TLS certificate configured.
Why it's wrong here
TLS is handled by the endpoint, not a certificate on the stream.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.