S3 Default Encryption with SSE-S3 for Minimal Operational Overhead
A data engineer is designing a data lake on Amazon S3. The data includes sensitive customer information that must be encrypted at rest. Which combination of actions meets this requirement with minimal operational overhead?
Quick Answer
The answer is to enable default encryption on the S3 bucket using SSE-S3. This is correct because SSE-S3 provides server-side encryption with Amazon S3-managed keys, where AWS handles all key management, automatic rotation, and encryption/decryption transparently, requiring no client-side changes or additional code. For the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your ability to balance security requirements with operational overhead—a common trap is choosing SSE-KMS or client-side encryption, which add complexity and cost for key management. Remember that when the question emphasizes “minimal operational overhead,” SSE-S3 is almost always the intended choice because it is fully managed and requires zero configuration beyond enabling default encryption. A useful memory tip: “SSE-S3 for simplicity, SSE-KMS for control.”
⚠ Common exam trap
It's easy for candidates to confuse 'enforcing encryption via bucket policy' (Option C) with 'automatically encrypting data' — the policy only denies unencrypted writes but does not reduce operational overhead because the client must still implement encryption logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption on the S3 bucket using SSE-S3
SSE-S3 provides server-side encryption with Amazon S3-managed keys, which encrypts data at rest with minimal operational overhead because AWS handles key management, rotation, and encryption/decryption transparently. Enabling default encryption on the S3 bucket ensures that all objects written to the bucket are automatically encrypted without requiring any client-side changes or additional code, meeting the requirement with the least administrative effort.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable default encryption on the S3 bucket using SSE-S3
Why this is correct
SSE-S3 encrypts objects at rest using server-side encryption with Amazon-managed key material, requiring no customer key management or KMS API calls. This satisfies the encryption-at-rest requirement while minimising operational overhead, as the engineer does not need to manage keys, rotate them, or configure custom key policies, unlike SSE-KMS or client-side encryption.
- ✗
Encrypt objects client-side before uploading
Why it's wrong here
Client-side encryption adds overhead and complexity.
- ✗
Use an S3 bucket policy to deny writes without encryption
Why it's wrong here
This enforces encryption but doesn't automatically encrypt objects.
- ✗
Use an S3 Lifecycle policy to transition to Glacier
Why it's wrong here
Lifecycle policies do not encrypt data.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is designing a data lake on Amazon S3. The data includes personally identifiable information (PII) that must be encrypted at rest. Which combination of actions meets the encryption requirement with the least operational overhead?
medium- A.Apply a bucket policy that denies access to unencrypted requests
- ✓ B.Enable default encryption on the S3 bucket using SSE-S3
- C.Use client-side encryption with AWS KMS
- D.Use server-side encryption with AWS KMS (SSE-KMS)
Why B: Enabling default encryption on the S3 bucket with SSE-S3 automatically encrypts all objects at rest using AES-256, managed entirely by AWS. This requires no additional configuration or key management, providing the least operational overhead while meeting the encryption requirement for PII.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.