SAP-C02 Continuous Improvement for Existing Solutions Practice Question
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/Admin"
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:CallerAccount": "123456789012"
}
}
},
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/Admin"
},
"Action": [
"kms:Decrypt"
],
"Resource": "*"
}
]
}
```
A solutions architect is reviewing the above KMS key policy. The Admin role cannot decrypt data using the key. What is the MOST likely reason?Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/Admin"
},
"Action": ["kms:Decrypt", "kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {"kms:CallerAccount": "123456789012"
}
}
},
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/Admin"
},
"Action": ["kms:Decrypt"
],
"Resource": "*"
}
]
}A solutions architect is reviewing the above KMS key policy. The Admin role cannot decrypt data using the key. What is the MOST likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is an explicit deny statement elsewhere in the policy.
The key policy shown does not contain any explicit deny statements, so the inability to decrypt must be due to an explicit deny elsewhere in the key policy (possibly not shown) or in an IAM policy attached to the role. Option B is incorrect because the kms:CallerAccount condition checks the AWS account ID of the principal making the request; when a role from account 123456789012 is assumed, the caller account is 123456789012, regardless of the user's origin. Therefore, the condition would pass, and the first statement would apply. Since both statements allow decryption, the only remaining explanation is an explicit deny somewhere.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The second statement does not include kms:GenerateDataKey, which is required for decryption.
Why it's wrong here
The second statement does not need kms:GenerateDataKey for decryption; Decrypt alone is sufficient. So this is not the reason.
- ✗
The condition in the first statement restricts decryption to requests coming from account 123456789012, but the role might be used by a user from a different account.
Why it's wrong here
This is incorrect. The kms:CallerAccount condition checks the account of the principal making the request. When the Admin role is assumed, the caller account is the role's account (123456789012), not the user's account. Therefore, the condition would pass, and the first statement would allow decryption. Even if the condition failed, the second statement allows decryption unconditionally.
- ✓
There is an explicit deny statement elsewhere in the policy.
Why this is correct
This is the most likely reason. Since the shown policy allows decryption via both statements, but the role still cannot decrypt, there must be an explicit deny statement elsewhere in the key policy that overrides these allows. Such a deny could be for the same actions or same principal.
- ✗
The condition key kms:CallerAccount is not a valid condition key for KMS key policies.
Why it's wrong here
kms:CallerAccount is a valid condition key for KMS key policies. It is used to restrict access based on the caller's AWS account. So this is not the issue.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.