DVA-C02 Question 37

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A3

  B. Allow access when "aws:SecureTransport": "false" ❌ This would allow HTTP instead of enforcing HTTPS. C. Role-based policy on other accounts' roles ❌ The bucket owner controls access, not external accounts. A bucket policy is required. D. Resource-based policy on the KMS key ❌ KMS policies control encryption keys, not transport security. HTTP/HTTPS enforcement must happen at the S3 bucket level.

• Chose A3

  A) Correct - The condition “aws:SecureTransport”: “false” ensures that only secure requests (encrypted in transit) are allowed. B) Eliminated - This allows access only when the request does not use secure transport. This is opposite of the requirement C) Eliminated - Resource-based policies at the bucket level are better suited for cross-account access. D) Eliminated - The GetObject operation is specific to the S3 bucket, not the KMS key.

• 1

  aws:SecureTransport condition does not apply to KMS key policies