A company has a guideline that mandates the encryption of all Amazon S3 bucket data in transit. A security engineer must implement an S3 bucket policy that denies any S3 operations if data is not…

Question

Exhibits

Options

• A{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "Bool": { "aws:SecureTransport": "true" } } }], "Principal": "*" }
• B{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } }], "Principal": "*" }
• C{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "AES256" } } }], "Principal": "*" }
• D{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "true" } } }], "Principal": "*" }

• A
  3% (1)
• B
  72% (26)
• C
  17% (6)
• D
  8% (3)

Explanation

Option B is correct because it uses the 'aws:SecureTransport' condition key set to 'false' with a Deny effect, which means any S3 operation that is NOT using SSL/TLS (HTTPS) will be denied. This effectively enforces encryption in transit by blocking all unencrypted (HTTP) requests. The logic is: if SecureTransport is false (i.e., the request is not encrypted), deny the action.

No community discussion yet for this question.