SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption on each S3 bucket.
Enabling default encryption on each S3 bucket ensures that all objects uploaded to that bucket are automatically encrypted, enforcing the policy across existing and future buckets. Option B is wrong because an IAM policy that denies s3:PutObject without encryption headers only applies when the request includes encryption headers; it does not enforce encryption for all objects, and it depends on the caller including the headers. Option C is wrong because while an S3 bucket policy can deny PutObject without encryption, it requires a policy per bucket and does not automatically remediate existing buckets. Option D is wrong because AWS Config can detect noncompliant buckets but requires a custom remediation action to enable encryption; it does not automatically enforce encryption without additional setup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable default encryption on each S3 bucket.
Why this is correct
Default encryption ensures all new objects are encrypted.
- ✗
Create an IAM policy that denies s3:PutObject unless encryption headers are present.
Why it's wrong here
IAM policies apply to users, not buckets.
- ✗
Use an S3 bucket policy to deny PutObject without encryption.
Why it's wrong here
This applies per bucket and requires manual setup.
- ✗
Use AWS Config to automatically remediate noncompliant buckets.
Why it's wrong here
Config can detect but not enable default encryption automatically.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.