easyMultiple Choice
CCSP Customer-Managed Encryption Key (CMEK) Practice Question
Exhibit
Refer to the exhibit. ``` Error: Access Denied. status code: 403, request id: QWERTY1234, host id: ABCD5678 User: arn:aws:iam::123456789012:user/data-analyst Action: s3:GetObject Resource: arn:aws:s3:::proprietary-data/reports/q4-2023.csv Additional detail: Encryption key access required. ```
An analyst receives the above error when trying to download a file from a cloud storage bucket. The bucket policy and user permissions appear correct. What is the most likely cause?
⚠ Common exam trap
ISC2 often tests the misconception that bucket policies and IAM permissions alone control access to encrypted objects, ignoring the separate key permission layer required for objects encrypted with customer-managed keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user lacks permission to decrypt the object using the customer-managed encryption key
When a cloud storage object is encrypted with a customer-managed encryption key (CMEK), the GetObject API call requires the user to have both GetObject permission on the bucket policy and Decrypt permission on the specific encryption key. Even if the bucket policy and user IAM permissions appear correct for storage actions, the absence of the decrypt permission on the key will cause an access denied error. This is a common misconfiguration because the error message does not explicitly mention the key, leading analysts to overlook the key permission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The object is encrypted with server-side encryption using a provider-managed key, which requires additional grants
Why it's wrong here
Provider-managed SSE keys are transparent to callers; no additional grants are needed to decrypt, so this cannot produce the error. Customer-managed KMS keys are the case where the caller's role or grant must include kms:Decrypt, which is why that distinction matters when diagnosing AccessDenied on encrypted objects.
- ✗
The bucket is configured to block all public access
Why it's wrong here
Block Public Access stops anonymous access, but the analyst is an authenticated user whose permissions and bucket policy are stated as correct, so it would not produce this denial. It would be the cause when an anonymous or public request is refused despite an otherwise permissive policy.
- ✗
The bucket policy denies all GetObject actions
Why it's wrong here
A blanket GetObject deny would surface as AccessDenied, but the stem states the bucket policy appears correct, so this contradicts the given evidence rather than explaining it. Deny statements are the right tool when you deliberately need to override all allows, such as enforcing an organisation-wide block on a sensitive prefix.
- ✓
The user lacks permission to decrypt the object using the customer-managed encryption key
Why this is correct
Bucket policies and identity permissions govern access to the object, but decryption of a customer-managed key requires separate key permissions. Without decrypt rights on the KMS key, the download fails even though the storage-level permissions appear correct.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.