Amazon
SCS-C02 · Question #126
A company has a guideline that mandates the encryption of all Amazon S3 bucket data in transit. A security engineer must implement an S3 bucket policy that denies any S3 operations if data is not encr
Sign in or unlock SCS-C02 to reveal the answer and full explanation for question #126. The question stem and answer options stay visible for context.
Submitted by naveen.iyer· Mar 6, 2026Security and Compliance – Implementing data protection and enforcing encryption policies for Amazon S3 using bucket policies and condition keys
Question
A company has a guideline that mandates the encryption of all Amazon S3 bucket data in transit. A security engineer must implement an S3 bucket policy that denies any S3 operations if data is not encrypted. Which S3 bucket policy will meet this requirement? A. B. C. D.
Exhibits
Options
- A{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "Bool": { "aws:SecureTransport": "true" } } }], "Principal": "*" }
- B{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } }], "Principal": "*" }
- C{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "AES256" } } }], "Principal": "*" }
- D{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowSSLRequestsOnly", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/" ], "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "true" } } }], "Principal": "*" }
Unlock SCS-C02 to see the answer
You've previewed enough free SCS-C02 questions. Unlock SCS-C02 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#S3 Bucket Policy#Encryption in Transit#aws:SecureTransport#IAM Conditions