The answer is to copy all objects to a new bucket that has default encryption set to SSE-KMS. This is correct because changing a bucket’s default encryption settings does not retroactively alter the encryption of existing objects; only newly uploaded objects are affected. By copying objects to a new bucket with SSE-KMS as the default, each object is re-encrypted during the copy operation using the customer-managed key, satisfying the compliance policy without modifying the original bucket’s configuration or disrupting existing applications. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding that S3 default encryption is not retroactive—a common trap is assuming you can simply update the bucket’s settings and be done. Remember the memory tip: “Default is for new, copy is for review”—meaning default encryption applies only to new uploads, so to change encryption on existing objects, you must copy them to a target with the desired encryption.
DEA-C01 Data Store Management Practice Question
This DEA-C01 practice question tests your understanding of data store management. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Amazon S3 to store historical financial records. A compliance policy requires that all objects be encrypted with a customer-managed key stored in AWS KMS. The bucket is already configured with SSE-S3. What is the LEAST disruptive way to change the encryption to SSE-KMS?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "least"
Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Copy all objects to a new bucket that has default encryption set to SSE-KMS.
Option C is correct because changing the default encryption settings of an existing bucket (SSE-S3 to SSE-KMS) does not retroactively encrypt objects that were already stored with SSE-S3. Copying all objects to a new bucket that has default encryption set to SSE-KMS ensures every object is encrypted with a customer-managed key, as the copy operation re-encrypts each object using the new bucket's default settings. This approach is the least disruptive because it avoids modifying the original bucket's configuration or policies, which could break existing applications or access patterns.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Add a bucket policy to enforce SSE-KMS.
Why it's wrong here
Policy can enforce encryption for new uploads but does not re-encrypt existing objects.
✗
Update the bucket's default encryption settings to SSE-KMS.
Why it's wrong here
Default encryption applies only to new objects; existing objects remain with SSE-S3.
✓
Copy all objects to a new bucket that has default encryption set to SSE-KMS.
Why this is correct
Copying objects to a new bucket with SSE-KMS default encryption will re-encrypt them with the new key and is straightforward.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use S3 Batch Operations to apply SSE-KMS to all existing objects.
Why it's wrong here
Batch Operations can copy objects with new encryption, but it's more complex and not the least disruptive.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume updating default encryption settings (Option B) will retroactively encrypt existing objects, but S3 default encryption only applies to new uploads, not to objects already stored with a different encryption method.
Detailed technical explanation
How to think about this question
When you copy an object within or between S3 buckets, the copy operation re-encrypts the object using the destination bucket's default encryption settings, effectively applying SSE-KMS if configured. This behavior is defined by the S3 PUT Object - Copy API, which reads the source object and writes a new object with the destination's encryption. In contrast, S3 Batch Operations invokes a similar copy action but requires additional setup for IAM roles and can be slower for large datasets, making the new-bucket copy approach simpler and less error-prone for compliance-driven migrations.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Data Store Management — This question tests Data Store Management — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Copy all objects to a new bucket that has default encryption set to SSE-KMS. — Option C is correct because changing the default encryption settings of an existing bucket (SSE-S3 to SSE-KMS) does not retroactively encrypt objects that were already stored with SSE-S3. Copying all objects to a new bucket that has default encryption set to SSE-KMS ensures every object is encrypted with a customer-managed key, as the copy operation re-encrypts each object using the new bucket's default settings. This approach is the least disruptive because it avoids modifying the original bucket's configuration or policies, which could break existing applications or access patterns.
What should I do if I get this DEA-C01 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "least". You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.