DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable S3 Default Encryption.

  Why this is correct

  S3 Default Encryption ensures that every object written to the bucket is automatically encrypted at rest, using either SSE-S3 (AES-256) or SSE-KMS (customer-managed KMS keys); SSE-C is not supported for default encryption. This protects the confidentiality of data at rest and helps satisfy compliance frameworks that mandate encryption. It is a direct security control for data confidentiality, but it does not control who can access the data.

• ✗

  Enable S3 Transfer Acceleration.

  Why it's wrong here

  Transfer Acceleration uses AWS edge locations to route uploads over the AWS backbone network, reducing latency and improving transfer speeds for large objects across long distances. However, it does not add any encryption, authentication, or access control mechanisms to the bucket itself. It simply optimizes network performance; therefore, enabling it has no impact on the security of the data stored in S3.

• ✗

  Enable S3 Cross-Region Replication.

  Why it's wrong here

  Cross-Region Replication (CRR) asynchronously copies objects to a bucket in a different AWS region, providing geographic redundancy and supporting disaster recovery and compliance requirements for data durability. While CRR improves availability and protects against region-level failures, it does not prevent unauthorized access or encrypt data; the destination bucket requires its own independent security configuration. Thus, CRR is a data-management feature, not a security control for the source bucket.

• ✗

  Enable S3 Versioning.

  Why it's wrong here

  Versioning keeps multiple versions of an object in the same bucket, which protects against accidental overwrites and deletes by enabling recovery of earlier states. However, versioning does not authenticate users, control who can read or write, or encrypt data; it merely preserves object history. In fact, if not combined with lifecycle rules and appropriate ACLs, versioning can increase the number of stored objects and potentially retain data that should have been removed, so it is not considered a security control.

• ✓

  Enable S3 Block Public Access.

  Why this is correct

  S3 Block Public Access is a bucket-level and account-level security control that can override existing bucket policies, ACLs, and object permissions that would otherwise grant public access to the bucket or its contents. By enabling this feature, you prevent the most common misconfiguration that leads to data breaches—publicly exposed S3 buckets containing sensitive data. It enforces a least-privilege model by ensuring that no object can be made publicly accessible, even if an individual object ACL is later misconfigured.

Go deeper

Related to this question