SCS-C02 Data Protection Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.

The bucket policy includes a Deny effect with a condition 'StringNotEquals': {'s3:x-amz-server-side-encryption': 'aws:kms'}. This condition denies requests only when the x-amz-server-side-encryption header is present in the request and its value is not 'aws:kms'. If the header is absent (as when the user does not specify encryption), the condition evaluates to false, meaning the Deny rule does not apply. Therefore, the upload is not denied by this policy. Since new S3 buckets have default encryption enabled with SSE-S3, the object will be encrypted with SSE-S3, and the upload succeeds. Option A is incorrect because the policy does not deny all requests; it only denies those that include a supported but non-matching encryption header. Option C is incorrect because it assumes the Deny applies when the header is absent, which is not the case for 'StringNotEquals' (without 'IfExists'). Option D is similar to B but B is the more precise statement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The upload fails because the policy denies all PutObject requests.
Why it's wrong here
The policy does not deny all; it only denies if encryption is not SSE-KMS.
✓
The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.
Why this is correct
Default encryption is not mentioned and does not override the policy.
✗
The upload fails because the policy denies PutObject when encryption is not SSE-KMS.
Why it's wrong here
The condition denies if encryption is not SSE-KMS; no encryption header leads to denial.
✗
The upload succeeds because the object is encrypted with SSE-S3 by default.
Why it's wrong here
No default encryption set; policy denies.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Data Protection Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question