DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that all data in an S3 bucket is encrypted at rest. The bucket currently contains unencrypted objects from past uploads. Which action will encrypt these existing objects without re-uploading them?
⚠ Common exam trap
The trap is assuming that enabling default encryption or a bucket policy retroactively encrypts existing objects — the exam tests whether you know that only a copy/rewrite operation (via Batch Operations or CLI copy) changes encryption on already-stored objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use S3 Batch Operations with an encryption job
S3 Batch Operations can run an encryption job across existing objects, applying SSE-S3, SSE-KMS, or SSE-C encryption without re-uploading the data. This is the only option that retroactively encrypts already-stored objects in place. Default encryption and bucket policies only affect new uploads, not existing objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a bucket policy requiring SSE-S3
Why it's wrong here
A bucket policy requiring SSE-S3 only rejects future non-compliant PUTs; it cannot retroactively encrypt objects already stored unencrypted. It is tempting because policies enforce encryption rules. The policy approach is correct when securing new uploads, whereas existing objects need re-encryption or copy-in-place.
- ✗
Enable default encryption on the bucket
Why it's wrong here
Default encryption only applies to new objects uploaded after it is enabled; it does not retroactively encrypt existing unencrypted objects. It is tempting because it is the standard way to enforce encryption going forward, and would be correct for a bucket with no pre-existing unencrypted data.
- ✗
Use the S3 console to select all objects and apply encryption
Why it's wrong here
The S3 console offers no bulk operation that rewrites existing objects to apply encryption; encryption is set per-object at write time, so this cannot work. It is tempting because console bulk actions exist for storage class and tags, and would suit re-encrypting objects via copy in a scripted workflow.
- ✓
Use S3 Batch Operations with an encryption job
Why this is correct
S3 Batch Operations applies a batch job that re-encrypts existing objects in place using SSE-KMS or SSE-S3, satisfying the stem's constraint of encrypting past uploads without re-uploading. It reads each object and writes it back encrypted, preserving keys and metadata.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.