SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "Bool": {"aws:SecureTransport": "false"}
      }
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {"s3:x-amz-server-side-encryption": "AES256"}
      }
    }
  ]
}

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

⚠ Common exam trap

The trap here is that candidates often focus on the encryption requirement (SSE-S3) and overlook the explicit Deny for HTTP transport, mistakenly thinking that encryption alone satisfies all conditions, when in fact the Deny for insecure transport takes precedence.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No, because the Deny statement blocks all HTTP requests regardless of encryption.

The Deny statement in the policy explicitly blocks all HTTP requests (using `aws:SecureTransport`: false) regardless of whether the request uses SSE-S3 encryption. Since the user is uploading via an unencrypted HTTP connection, the Deny statement matches and overrides any Allow statement, causing the upload to fail. AWS IAM policy evaluation is explicit deny by default, so the Deny takes precedence.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Yes, because the Deny statement only applies to non-encrypted requests.
Why it's wrong here
The Deny applies to all S3 actions via HTTP, regardless of encryption.
✗
Yes, because the request uses SSE-S3 encryption which satisfies the Allow statement.
Why it's wrong here
The Deny statement for HTTP overrides the Allow.
✓
No, because the Deny statement blocks all HTTP requests regardless of encryption.
Why this is correct
The Deny condition is on SecureTransport false, so any HTTP request is denied.
✗
No, because the Allow statement requires HTTPS transport.
Why it's wrong here
The Allow does not require HTTPS; it requires SSE-S3. But the Deny blocks HTTP anyway.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question