SCS-C02 Management and Security Governance Practice Question
A security engineer is auditing an S3 bucket policy that allows cross-account access. The engineer wants to ensure that only encrypted connections are permitted. Which condition should be added to the policy?
⚠ Common exam trap
The trap is confusing in-transit encryption (aws:SecureTransport) with at-rest encryption (s3:x-amz-server-side-encryption); candidates who pick the latter misunderstand which layer the condition controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aws:SecureTransport
The aws:SecureTransport condition key evaluates to true when the request is made over HTTPS/TLS and false over HTTP. Adding a Deny statement with 'aws:SecureTransport: false' ensures that any non-TLS request to the bucket is rejected, enforcing encrypted connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aws:SourceIp
Why it's wrong here
aws:SourceIp restricts access by originating IP address, so it cannot enforce TLS on a connection; a client using plain HTTP from an allowed address still succeeds. It suits allow-listing known corporate ranges or blocking anonymous callers. Denying requests where aws:SecureTransport is false is what enforces encryption in transit.
- ✗
aws:Referer
Why it's wrong here
aws:Referer inspects the HTTP Referer header, which clients control and can spoof, so it cannot enforce TLS on S3 requests. It is tempting because it restricts access to requests originating from specific web pages, which suits hotlink protection for public website assets, not transport encryption. Denying requests where aws:SecureTransport is false is what enforces HTTPS.
- ✓
aws:SecureTransport
Why this is correct
The aws:SecureTransport condition key evaluates whether the request arrived over TLS, returning false for plain HTTP. Adding it with a Boolean false value denies unencrypted access, satisfying the stem's requirement that only encrypted connections reach the cross-account bucket.
- ✗
s3:x-amz-server-side-encryption
Why it's wrong here
The `s3:x-amz-server-side-encryption` condition checks the encryption algorithm requested for stored objects, not the transport protocol, so it cannot block plaintext HTTP requests. It is tempting because it enforces server-side encryption at rest, and would be correct when the requirement is mandating AES256 or `aws:kms` on uploads.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.