SAP-C02 Design for New Solutions Practice Question

A company is designing a new application that will use Amazon S3 to store user-uploaded images. The application must enforce that all uploads are encrypted in transit and at rest. Additionally, the bucket must be configured to block all public access. Which TWO actions should be taken to meet these requirements?

⚠ Common exam trap

Watch out — candidates often confuse enforcing encryption in transit (via bucket policy condition aws:SecureTransport) with ensuring encryption at rest (via default encryption), and may overlook that Block Public Access settings are required to explicitly block all public access, even if the bucket policy seems restrictive.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.

Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects stored in the bucket are encrypted at rest automatically, even if the upload request does not include encryption headers. Option E is correct because configuring the S3 Block Public Access settings to block all public access prevents any public access to the bucket and its objects, meeting the requirement to block all public access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
SSE-C requires the customer to manage the encryption keys themselves, but the question mandates that the bucket block all public access and enforce encryption at rest; SSE-C does not inherently block public access nor does it provide a bucket-level policy to enforce encryption in transit via TLS. It is tempting because SSE-C does encrypt objects at rest with a key the customer controls, which would be correct if the requirement were solely about managing encryption keys without needing automated bucket-wide access controls or transport-layer enforcement.
✓
Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.
Why this is correct
Default encryption ensures all objects are encrypted at rest automatically.
✗
Use Amazon CloudFront to serve the images and enforce HTTPS.
Why it's wrong here
CloudFront enforces HTTPS in transit but does not address encryption at rest or public access blocking.
✗
Create a bucket policy that denies uploads without encryption in transit.
Why it's wrong here
Bucket policies can deny requests that are not using HTTPS, but the question asks for encryption at rest and blocking public access.
✓
Configure the S3 Block Public Access settings to block all public access.
Why this is correct
This prevents any public access to the bucket and its objects.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Design for New Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question