DEA-C01 Data Security and Governance Practice Question

A company needs to enforce encryption at rest for all data stored in Amazon S3. Which of the following are valid methods to achieve this? (Choose TWO.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable default bucket encryption using SSE-S3.

Option B is correct because enabling default bucket encryption with SSE-S3 causes Amazon S3 to automatically encrypt every object at rest using AES-256 with S3-managed keys, satisfying the requirement without any client changes. Option D is correct because client-side encryption encrypts the data before it ever reaches S3, so the objects are stored in encrypted form and remain protected at rest regardless of server-side settings. Option A is incorrect because S3 Transfer Acceleration only speeds up uploads over AWS edge locations and does not encrypt data at rest. Option C is incorrect because S3 Versioning only preserves multiple object versions and does not provide encryption. Option E is incorrect because SSL/TLS protects data in transit between the client and S3, not data at rest in the bucket.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use Amazon S3 Transfer Acceleration.
Why it's wrong here
Transfer Acceleration speeds uploads over long distances using edge locations; it does not encrypt objects at rest. It would be the right choice when reducing transfer latency for geographically distant clients matters, but here the requirement is server-side encryption via SSE-S3, SSE-KMS or SSE-C.
✓
Enable default bucket encryption using SSE-S3.
Why this is correct
Default bucket encryption with SSE-S3 applies AES-256 encryption automatically to every object written to the bucket, satisfying encryption at rest without per-object configuration. It is a bucket-level setting, so new uploads inherit it and existing unencrypted objects are not retroactively encrypted.
✗
Enable S3 Versioning.
Why it's wrong here
Versioning preserves prior object versions for recovery; it stores data unencrypted unless an encryption setting is applied separately. It would be correct when protecting against accidental overwrites or deletes, but the stem demands encryption at rest, satisfied by SSE-S3, SSE-KMS or SSE-C.
✓
Use client-side encryption before uploading objects.
Why this is correct
Client-side encryption encrypts data before it leaves the client, so objects arrive at S3 already ciphertext and are stored encrypted at rest. The customer manages keys entirely outside AWS, satisfying the encryption-at-rest requirement independently of any bucket-level server-side encryption setting.
✗
Use SSL/TLS for all S3 API calls.
Why it's wrong here
SSL/TLS encrypts data in transit, not at rest.

Quick reference

Symmetric Encryption Algorithm Comparison

Algorithm	Key Size	Block Size	Status	Notes
AES-128	128-bit	128-bit	Current standard	NIST approved; WPA3, TLS
AES-256	256-bit	128-bit	Current standard	Preferred for sensitive / govt data
3DES	112-bit effective	64-bit	Deprecated (2023)	Replaced by AES
DES	56-bit	64-bit	Broken	Cracked in < 24 h; never deploy
ChaCha20	256-bit	Stream cipher	Current	TLS 1.3, WireGuard

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

Symmetric Encryption Algorithm Comparison

Related to this question