SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company has an Amazon S3 bucket that stores sensitive data. They want to ensure that all objects in the bucket are encrypted at rest. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.
Enabling default encryption on the bucket ensures all new objects are encrypted. Option A is wrong because CloudTrail only logs and does not enforce encryption. Option C is wrong because versioning does not enforce encryption. Option D is wrong because a bucket policy that denies PutObject if not encrypted can be circumvented or does not cover existing objects, but default encryption is more straightforward.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS CloudTrail to monitor for unencrypted objects.
Why it's wrong here
CloudTrail only logs and does not enforce encryption, so it does not ensure all objects are encrypted.
- ✓
Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.
Why this is correct
Enabling default encryption using SSE-S3 or SSE-KMS ensures that all new objects written to the bucket are encrypted at rest.
- ✗
Enable S3 Versioning to protect objects.
Why it's wrong here
Versioning maintains multiple versions of objects but does not enforce encryption; objects can still be stored unencrypted.
- ✗
Create a bucket policy that denies PutObject if the object is not encrypted.
Why it's wrong here
A bucket policy that denies PutObject if the object is not encrypted can be circumvented by authorized users with additional permissions, and it does not cover existing objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.