SOA-C02 Security and Compliance Practice Question
A company stores sensitive data in an Amazon S3 bucket. A security audit reveals that some objects were uploaded without server-side encryption. The SysOps administrator must ensure that all future PUT requests to the bucket are denied unless they include the x-amz-server-side-encryption header with the value AES256. Which action should the administrator take?
⚠ Common exam trap
The trap here is thinking that enabling default encryption prevents unencrypted uploads; default encryption only encrypts objects after they are uploaded and does not reject requests missing the encryption header.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an S3 bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption condition key is not present or does not equal AES256.
A bucket policy with a Deny effect on s3:PutObject when the s3:x-amz-server-side-encryption condition is absent or not AES256 enforces the requirement for all requests to the bucket. This is the most direct and centralized method, as it applies to any principal attempting to upload without the required header, regardless of their IAM permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure default encryption on the bucket using SSE-S3 and enable the bucket key feature.
Why it's wrong here
Default encryption automatically encrypts objects at rest, but it does not deny PUT requests that omit the encryption header. The requirement is to deny requests that do not include the header, not merely to encrypt after the fact. Default encryption would still allow unencrypted uploads to succeed and then encrypt them, which does not meet the audit's demand to deny such requests.
- ✗
Attach an IAM policy to all users that allows s3:PutObject only when the s3:x-amz-server-side-encryption condition key equals AES256.
Why it's wrong here
An IAM policy can enforce the condition for the users it is attached to, but it does not cover all possible principals, such as other AWS accounts or anonymous users if the bucket allows them. A bucket policy is the centralized way to enforce conditions on all requests to the bucket. Moreover, IAM policies are evaluated in addition to bucket policies, and a user with a permissive bucket policy could still bypass the IAM condition. Thus, this is not the most direct or comprehensive enforcement.
- ✗
Enable S3 Block Public Access on the bucket and require encryption in the bucket policy.
Why it's wrong here
S3 Block Public Access prevents public access but does not enforce encryption headers on PUT requests. A bucket policy can deny requests missing encryption, but Block Public Access alone does not check the x-amz-server-side-encryption header. Combining it with a policy could work, but the question asks for the action to deny unencrypted PUTs; Block Public Access is not the direct mechanism and may not be sufficient if the policy is not correctly configured.
- ✓
Create an S3 bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption condition key is not present or does not equal AES256.
Why this is correct
An S3 bucket policy can use the s3:x-amz-server-side-encryption condition key to require that PUT requests include the x-amz-server-side-encryption header with a specific value. By denying s3:PutObject when the condition is not met, the policy blocks any upload that lacks the required encryption header. This directly enforces the requirement at the bucket level for all principals.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.