SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the bucket's default encryption configuration to SSE-KMS.
Changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys. Option D is incorrect because existing objects are not re-encrypted by default encryption changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a lifecycle policy to transition objects to SSE-KMS.
Why it's wrong here
Lifecycle policies do not modify encryption settings.
- ✗
Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.
Why it's wrong here
Using S3 Batch Operations to copy objects and re-encrypt them with SSE-KMS is not the simplest method to achieve the desired outcome. This approach involves creating new object versions, which is an unnecessary step. The simplest way to implement SSE-KMS for new objects is by configuring the S3 bucket's default encryption settings. However, S3 Batch Operations are highly effective for bulk re-encryption of *existing* objects, making it a suitable choice when a large number of objects already encrypted with SSE-S3 need to be updated to SSE-KMS.
- ✓
Change the bucket's default encryption configuration to SSE-KMS.
Why this is correct
Default encryption applies automatically to all new objects; existing objects remain with SSE-S3.
- ✗
Use a bucket policy to deny uploads without SSE-KMS.
Why it's wrong here
This only enforces encryption for future uploads but does not encrypt existing objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.