Get Your CertDEA-C01PlayCompete
‹ All DEA-C01 questions

DEA-C01 Practice Question 99: S3 Bucket Policy Secure Transport

AWS Certified Data Engineer – Associate (DEA-C01) · Test 10 · question 9 of 10

Data Security and Governanceeasy

A compliance policy requires that all access to the objects in an Amazon S3 data lake bucket use encrypted connections. Some older applications still call the bucket over plain HTTP. How should the data engineer enforce the policy?

Select one answer
Show answer and explanation

Answer:

  • A. Deny requests in a bucket policy when aws:SecureTransport is false.

AWS recommends to *"enforce encryption of data in transit"* by *"allowing only encrypted connections over HTTPS (TLS) by using the aws:SecureTransport condition in your Amazon S3 bucket policies."* A statement that denies all S3 actions when aws:SecureTransport is false rejects plain HTTP requests (option A). AWS also suggests the s3-bucket-ssl-requests-only AWS Config rule as a detective control.

- B is wrong because default encryption protects objects at rest. It does not require clients to use HTTPS. - C is wrong because a VPC endpoint policy limits which principals and buckets can be reached through the endpoint. It does not require TLS, and HTTP requests from the VPC would still work. - D is wrong because MFA conditions control who can act, not how the connection is encrypted. Requests over plain HTTP could still satisfy them.

Reference: Security best practices for Amazon S3

Practice Test 10 ›

Study guides for DEA-C01

AWS Developer Associate exam guide: DVA-C02 to DVA-C03AWS Developer Associate exam: DVA-C02 ends 30 November 2026 and DVA-C03 starts 1 December. What changes, which to sit, format, price and study plan.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Microsoft Fabric certification: DP-700 vs DP-600Microsoft Fabric certification means two exams, DP-600 and DP-700. Their roles, skills, format, cost in India, and which one to take first.
Databricks Data Engineer Associate vs AWS DEA-C01Databricks Data Engineer Associate vs AWS Certified Data Engineer – Associate - format, cost, topics and which one to take for your job, as of 2026.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is AWS Glue? Data Catalog, Crawlers and ETL JobsWhat is AWS Glue? The Data Catalog, crawlers, ETL jobs and DPUs, workflows, streaming, job bookmarks, Flex and Data Quality, plus the traps AWS exams set.