DEA-C01 S3 Bucket Policy Practice Question
A company has an S3 bucket with versioning enabled and a bucket policy that denies access if the request does not include encryption. A data engineer notices that some objects are not encrypted. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy only applies to new uploads; existing objects remain unencrypted.
A bucket policy that denies unencrypted requests only applies to new uploads made after the policy is effective. Objects already in the bucket remain unencrypted. Option A is wrong because bucket policies apply to all requests, including those from the same account. Option C is wrong because default encryption would only apply to new objects, not existing ones. Option D is wrong because versioning does not retroactively encrypt existing objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket policy does not evaluate requests from the same account.
Why it's wrong here
Bucket policies evaluate requests from all principals, including the same account, so this is not the cause.
- ✓
The policy only applies to new uploads; existing objects remain unencrypted.
Why this is correct
Correct. The policy only enforces encryption on new uploads; existing objects remain as they were before the policy was applied.
- ✗
Default encryption was not enabled at the bucket level.
Why it's wrong here
Default encryption automatically encrypts new objects, but existing objects would not be affected. However, the question is about objects that are not encrypted, which are likely existing objects.
- ✗
Versioning was enabled after the objects were uploaded.
Why it's wrong here
Versioning allows multiple versions of an object, but it does not change the encryption status of existing object versions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.