DVA-C02 Development with AWS Services Practice Question
A company stores sensitive user data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The bucket already has default encryption configured with SSE-S3. What is the MINIMUM change needed to meet the requirement?
⚠ Common exam trap
Test-takers frequently confuse enforcing encryption via bucket policies (which only denies non-compliant uploads) with actually setting the encryption method via default encryption, which automatically applies the required encryption to all objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the default encryption of the bucket to SSE-KMS with the desired KMS key.
The current bucket has default encryption set to SSE-S3, which uses AWS-managed keys, not customer-managed KMS keys. Changing the default encryption to SSE-KMS with the desired customer-managed KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that key, meeting the security team's requirement without additional per-object configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change the default encryption of the bucket to SSE-KMS with the desired KMS key.
Why this is correct
Changing the S3 bucket's default encryption to SSE-KMS with a specified AWS KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that customer-managed key. This eliminates the need for individual uploaders to specify encryption headers, significantly reducing the risk of unencrypted data and simplifying compliance requirements for sensitive user data. It's the most robust and operationally efficient method to enforce encryption for all objects.
- ✗
Add an object-level encryption setting to each object after upload.
Why it's wrong here
Adding object-level encryption settings *after* upload introduces significant operational overhead and a high risk of human error. This manual process requires a separate action for each object, making it inefficient for large datasets and prone to omissions, potentially leaving sensitive data unencrypted. Relying on post-upload manual steps is not a scalable or reliable solution for ensuring comprehensive data protection.
- ✗
Enable S3 Bucket Keys on the bucket.
Why it's wrong here
Enabling S3 Bucket Keys is a cost optimization feature for server-side encryption with KMS (SSE-KMS), designed to reduce the number of requests to AWS KMS. It allows S3 to generate a short-lived data key from the KMS key, which is then used to encrypt multiple objects, rather than requesting a unique data key for each object from KMS. However, S3 Bucket Keys do not *initiate* or *change* the encryption type; they only modify the KMS request pattern for existing SSE-KMS configurations.
- ✗
Attach a bucket policy that denies uploads without the required KMS key.
Why it's wrong here
Attaching a bucket policy that denies uploads without the required KMS key acts as a preventative control, enforcing that client-side uploads must specify the correct encryption headers. While this policy can *prevent* unencrypted objects from being stored, it does not *perform* the encryption itself; it merely rejects non-compliant uploads. This approach relies on the uploader to correctly configure encryption, which is less reliable and more complex than setting default bucket encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.