DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable S3 Server-Side Encryption (SSE-S3 or SSE-KMS)

  Why this is correct

  S3 Server-Side Encryption (SSE-S3 or SSE-KMS) transparently encrypts object data before it is written to disk and decrypts it when the object is read, using either S3-managed AES-256 keys or AWS KMS-managed customer keys. This ensures that objects stored in the bucket are unreadable without the appropriate decryption key, directly protecting data at rest. For SSE-KMS, the service also provides envelope encryption, key rotation, and fine-grained access control through IAM policies.

• ✗

  Enable cross-region replication

  Why it's wrong here

  Cross-Region Replication (CRR) asynchronously copies objects from a source bucket to a destination bucket in a different AWS Region, primarily to support disaster recovery, compliance, or low-latency access. Replication itself does not apply cryptographic protections; if the source objects are plaintext, the replicas in the destination bucket remain plaintext unless you separately configure default encryption on the destination bucket. This is an availability/durability control, not a data-at-rest confidentiality control.

• ✗

  Enable MFA Delete on the bucket

  Why it's wrong here

  MFA Delete adds an extra authentication factor before a user can permanently delete an object version or suspend/enable versioning on the bucket. This feature protects against accidental or malicious deletion by requiring a physical MFA token, but it does not encrypt data or restrict read access. Data-at-rest confidentiality is not improved because MFA Delete only affects delete operations, not how data is stored or accessed.

• ✓

  Create a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header

  Why this is correct

  A bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header forces all new object uploads to explicitly request SSE, making encryption mandatory at write time. This policy-based control prevents client applications from bypassing encryption and ensures that objects stored in the bucket are encrypted from the moment they are uploaded. It does not encrypt existing unencrypted objects, so it is typically paired with a default encryption setting or a backfill job.

• ✗

  Use S3 Transfer Acceleration

  Why it's wrong here

  S3 Transfer Acceleration leverages AWS edge locations to route objects over an optimized network path, reducing latency and improving throughput for large uploads across long distances. This feature only optimizes data in transit and is unrelated to encryption; data at rest in S3 is stored exactly as uploaded, without any added cryptographic protection. Therefore, Transfer Acceleration is a performance feature, not a security control for data at rest.

Go deeper

Related to this question