DEA-C01 Data Security and Governance Practice Question

A company wants to enable automatic encryption for all new objects written to an S3 bucket. The bucket has existing objects that are unencrypted. Which solution meets these requirements with the least operational overhead?

⚠ Common exam trap

The trap is reading 'existing objects are unencrypted' as a requirement to encrypt them — the question only requires automatic encryption for new objects, so candidates who over-engineer with Batch Operations or bucket policies pick the wrong answer.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable default encryption on the bucket using SSE-S3

Enabling default encryption on the bucket with SSE-S3 causes all new objects written to the bucket to be encrypted automatically without any client-side changes or bucket policy enforcement. It is a single bucket-level setting, so it has the least operational overhead. Existing unencrypted objects remain unencrypted until rewritten, but the requirement only specifies automatic encryption for new objects.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure a lifecycle policy to transition objects to a new bucket with encryption
Why it's wrong here
Lifecycle policies transition objects between storage classes or expire them; they cannot apply encryption to existing unencrypted objects, and copying to another bucket adds operational overhead. Lifecycle rules suit cost-tiering, such as moving aged data to S3 Glacier, not retrofitting encryption.
✓
Enable default encryption on the bucket using SSE-S3
Why this is correct
Enabling SSE-S3 default encryption applies AES-256 encryption automatically to every new object with no key management, and existing unencrypted objects remain readable. This satisfies both requirements with minimal operational overhead compared with SSE-KMS or re-uploading objects.
✗
Use S3 server-side encryption with S3 managed keys (SSE-S3) and apply a bucket policy that denies writes without encryption
Why it's wrong here
Applying SSE-S3 with a bucket policy effectively enforces encryption for all *new* objects uploaded to the bucket, which is a valid requirement. However, this solution fails to address the existing unencrypted objects mentioned in the scenario. A bucket policy only governs future write operations, providing no mechanism to encrypt previously stored, unencrypted data. It would be the correct choice if only new object encryption was required, or if the bucket contained no existing unencrypted objects.
✗
Use S3 Batch Operations to copy existing objects with SSE-S3
Why it's wrong here
S3 Batch Operations copies existing objects but does not enable default encryption on the bucket, so new objects remain unencrypted. It is tempting because Batch Operations is designed for bulk remediation of existing objects, and would be correct for re-encrypting a backlog, but default encryption requires a bucket policy or PutBucketEncryption.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question