SCS-C03 Data Protection Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-secure-bucket/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "aws:kms"
}
}
}
]
}Refer to the exhibit. A developer is attempting to upload an object to 'my-secure-bucket' using the AWS CLI but receives an 'Access Denied' error. The developer's command was: 'aws s3 cp file.txt s3://my-secure-bucket/file.txt'. What is the most likely cause of the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer failed to include the '--sse aws:kms' parameter in the CLI command, violating the bucket policy condition.
The bucket policy explicitly denies any s3:PutObject request that does not include the SSE-KMS encryption header. The CLI command used by the developer did not specify an encryption method, causing the request to lack the required 's3:x-amz-server-side-encryption' header, which triggered the 'Deny' effect in the bucket policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer does not have the kms:GenerateDataKey permission for the default KMS key used by the bucket.
Why it's wrong here
While the developer might need KMS permissions, the 'Access Denied' in this specific context is triggered by the S3 bucket policy's 'Deny' statement before KMS is even involved. The policy checks for the presence and value of the encryption header in the incoming S3 API request, which is missing in the command.
- ✓
The developer failed to include the '--sse aws:kms' parameter in the CLI command, violating the bucket policy condition.
Why this is correct
The bucket policy requires the encryption header to be set to 'aws:kms'. By default, the S3 CLI 'cp' command does not add this header. The developer must explicitly specify the server-side encryption method to satisfy the condition in the bucket policy and avoid the Deny effect.
- ✗
The bucket policy is missing a 'Sid' (Statement ID) which makes the policy invalid and causes S3 to default to a 'Deny' for all requests.
Why it's wrong here
A 'Sid' is an optional field in an IAM or bucket policy and its absence does not make the policy invalid. The policy is syntactically correct as shown. The error is caused by the logic of the 'Deny' statement and the condition, not by a missing optional metadata field in the JSON structure.
- ✗
The 'Resource' ARN in the policy is incorrectly formatted because it uses a wildcard, which is not allowed for s3:PutObject actions.
Why it's wrong here
The resource ARN 'arn:aws:s3:::my-secure-bucket/*' is correctly formatted for object-level actions like s3:PutObject. Wildcards are required here to apply the policy to all objects within the bucket. Without the wildcard, the policy would apply to the bucket itself, which is not appropriate for object upload actions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.