SAP-C02 Continuous Improvement for Existing Solutions Practice Question

• A.Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.
• B.Create an AWS Lambda function that encrypts objects after they are uploaded.
• C.Configure an S3 Access Point with a policy that requires encryption.
• ✓ D.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.

Why D: Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

• A.Use S3 Lifecycle policies to transition objects to SSE-S3.
• B.Enable default encryption on the bucket with SSE-S3.
• ✓ C.Update the bucket policy to deny uploads with SSE-KMS.
• D.Use S3 Object Lambda to change encryption.

Why C: Updating the bucket policy to explicitly deny uploads with SSE-KMS ensures that only SSE-S3 encryption is allowed. The current policy denies uploads without the x-amz-server-side-encryption header set to AES256, but it does not prevent uploads that specify SSE-KMS (which uses a different header value). By adding a deny condition for SSE-KMS, the company can enforce SSE-S3 exclusively. Option A is incorrect because S3 Lifecycle policies manage object transitions and expiration, not encryption enforcement. They cannot change encryption of existing objects or prevent new uploads with unauthorized encryption. Option B is incorrect because enabling default encryption on the bucket applies only to objects uploaded without explicit encryption headers. It does not block uploads that specify SSE-KMS or other encryption methods, as the request headers override default encryption. Option D is incorrect because S3 Object Lambda is designed to transform data when objects are retrieved, not to enforce encryption settings on new uploads. It cannot change the encryption of objects at rest.