SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Correct answer & explanation

Updating the bucket policy to explicitly deny uploads with SSE-KMS ensures that only SSE-S3 encryption is allowed. The current policy denies uploads without the x-amz-server-side-encryption header set to AES256, but it does not prevent uploads that specify SSE-KMS (which uses a different header value). By adding a deny condition for SSE-KMS, the company can enforce SSE-S3 exclusively. Option A is incorrect because S3 Lifecycle policies manage object transitions and expiration, not encryption enforcement. They cannot change encryption of existing objects or prevent new uploads with unauthorized encryption. Option B is incorrect because enabling default encryption on the bucket applies only to objects uploaded without explicit encryption headers. It does not block uploads that specify SSE-KMS or other encryption methods, as the request headers override default encryption. Option D is incorrect because S3 Object Lambda is designed to transform data when objects are retrieved, not to enforce encryption settings on new uploads. It cannot change the encryption of objects at rest.