SAP-C02 Design for New Solutions Practice Question

Exhibit

Refer to the exhibit.

```
# CloudFormation template snippet
Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-unique-bucket-123
      VersioningConfiguration:
        Status: Enabled
  MyBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Deny
            Principal: "*"
            Action: s3:PutObject
            Resource: !Sub "${MyBucket.Arn}/*"
            Condition:
              Bool:
                aws:SecureTransport: "false"
```

An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

⚠ Common exam trap

Many exam-takers assume 'Bool' works identically to 'BoolIfExists' for condition keys that may be absent, leading them to overlook the subtle difference in how missing keys are handled in IAM policy evaluation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.

The condition key 'aws:SecureTransport' may not be present in all requests (e.g., anonymous requests or certain SDK versions). Using 'Bool' will cause the policy to evaluate to false when the key is missing, allowing unencrypted uploads. 'BoolIfExists' returns true if the key does not exist, effectively blocking requests without the key, which enforces encryption in transit more robustly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.
Why this is correct
Using 'BoolIfExists' ensures the policy is evaluated even if the condition key is missing, while 'Bool' may not evaluate correctly in all scenarios.
✗
The 'aws:SecureTransport' condition key is misspelled; it should be 'aws:SecureTransport' with a capital T.
Why it's wrong here
The spelling is correct as 'aws:SecureTransport'.
✗
The bucket policy is missing an 'Allow' statement for HTTPS requests.
Why it's wrong here
An explicit deny overrides any allow, so an allow statement is not needed.
✗
The resource ARN should be 'arn:aws:s3:::my-unique-bucket-123' without the '/*' to cover PutObject actions.
Why it's wrong here
PutObject requires the object ARN (with '/*') to apply to all objects.

Go deeper

SAP-C02 Design for New Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question