easyMultiple ChoiceObjective-mapped

CCSP Customer-Managed Encryption Key (CMEK) Practice Question

Exhibit

Refer to the exhibit.

```
Error: Access Denied.
  status code: 403, request id: QWERTY1234, host id: ABCD5678
  User: arn:aws:iam::123456789012:user/data-analyst
  Action: s3:GetObject
  Resource: arn:aws:s3:::proprietary-data/reports/q4-2023.csv
  Additional detail: Encryption key access required.
```

An analyst receives the above error when trying to download a file from a cloud storage bucket. The bucket policy and user permissions appear correct. What is the most likely cause?

⚠ Common exam trap

ISC2 often tests the misconception that bucket policies and IAM permissions alone control access to encrypted objects, ignoring the separate key permission layer required for objects encrypted with customer-managed keys.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user lacks permission to decrypt the object using the customer-managed encryption key

When a cloud storage object is encrypted with a customer-managed encryption key (CMEK), the GetObject API call requires the user to have both GetObject permission on the bucket policy and Decrypt permission on the specific encryption key. Even if the bucket policy and user IAM permissions appear correct for storage actions, the absence of the decrypt permission on the key will cause an access denied error. This is a common misconfiguration because the error message does not explicitly mention the key, leading analysts to overlook the key permission.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The object is encrypted with server-side encryption using a provider-managed key, which requires additional grants
Why it's wrong here
SSE-S3 does not require key access; SSE-KMS does.
✗
The bucket is configured to block all public access
Why it's wrong here
Block public access would give a different error.
✗
The bucket policy denies all GetObject actions
Why it's wrong here
Error says encryption key access required, not a bucket policy deny.
✓
The user lacks permission to decrypt the object using the customer-managed encryption key
Why this is correct
The error indicates missing KMS decrypt permission.

Go deeper

CCSP Customer-Managed Encryption Key (CMEK) Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question