← SCS-C02·Amazon Web Services

SCS-C02 Data Protection Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Id": "PolicyForDataProtection",
  "Statement": [
    {
      "Sid": "DenyIncorrectEncryptionHeader",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    },
    {
      "Sid": "DenyUnencryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": "true"
        }
      }
    }
  ]
}

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

⚠ Common exam trap

SCS-C02 often tests the difference between 'the request is encrypted' and 'the request satisfies the policy condition' — candidates see AES256 and assume encryption is enough, missing that the policy demands a specific encryption type.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The upload fails because the encryption header does not match 'aws:kms'.

The bucket policy explicitly requires the condition that the encryption header equals 'aws:kms', which enforces SSE-KMS. When the application sends 'x-amz-server-side-encryption: AES256' (which requests SSE-S3), the request does not satisfy the policy condition, so S3 denies the upload with an AccessDenied error. The policy's condition is a hard gate, not a preference.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The upload succeeds because the policy allows SSE-S3.
Why it's wrong here
The bucket policy explicitly denies uploads using SSE-S3 (AES256), so the request is rejected regardless of allowance wording. It tempts because SSE-S3 is a valid default encryption method, and would succeed in a bucket whose policy does not exclude that algorithm.
✓
The upload fails because the encryption header does not match 'aws:kms'.
Why this is correct
The bucket policy condition requires the aws:kms encryption algorithm, but the request specifies AES256. Since the header value fails the condition, S3 rejects the PutObject call with an access denied error rather than storing the object.
✗
The upload succeeds because the object is encrypted.
Why it's wrong here
AES256 denotes SSE-S3, which the bucket policy's explicit deny on that algorithm rejects, so the upload fails despite encryption being present. It tempts because encryption at rest is normally sufficient for compliance, and SSE-S3 would be accepted where the policy permits it.
✗
The upload fails because the header is missing.
Why it's wrong here
The header is present and correctly formatted, so the failure stems from the policy denying the AES256 algorithm, not from a missing header. It tempts because absent encryption headers do trigger policy denials, which is the actual cause in scenarios where no header is supplied.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

SCS-C02 Practice Exam 1 — 20 Questions→Free SCS-C02 Practice Test 3 — 30 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Data Protection Threat Detection and Incident Response Security Logging and Monitoring

Practice by scenario

Pick a question style and work only that format until it feels routine.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Data Protection practice questions SCS-C02 scenario practice questions Infrastructure Security practice questions Identity and Access Management practice questions Threat Detection and Incident Response practice questions

Keep going

Exam domains All SCS-C02 questions Study guide

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.

SCS-C02 Data Protection Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question