SCS-C03 Data Protection Practice Question

A company wants to ensure that all new Amazon EBS volumes created in their account are automatically encrypted, regardless of whether the developer specifies encryption during the volume creation process. Which AWS feature should be used?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable 'EBS encryption by default' in the EC2 dashboard for each specific AWS region.

EBS encryption by default is a region-specific setting that ensures every new EBS volume and snapshot copy created in the account is encrypted. This provides a safety net for security compliance, ensuring that no unencrypted data is inadvertently stored on block storage due to human error or misconfigured automation scripts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable 'EBS encryption by default' in the EC2 dashboard for each specific AWS region.
Why this is correct
EBS encryption by default is a regional setting that, once enabled, automatically encrypts all new volumes and snapshots using a specified KMS key. This is the most effective way to enforce encryption at rest for block storage without requiring developers to change their existing workflows or deployment scripts.
✗
Create an IAM policy that denies the 'ec2:CreateVolume' action if the 'Encrypted' parameter is false.
Why it's wrong here
While an IAM policy can enforce encryption by denying unencrypted requests, it is a reactive approach that results in failed API calls. This can disrupt development workflows and requires complex policy management. Encryption by default is a seamless, proactive setting that automatically applies encryption without failing the request.
✗
Use an AWS Config rule to automatically delete any EBS volume that is found to be unencrypted.
Why it's wrong here
AWS Config rules are detective and corrective controls, not preventative ones. Deleting a volume after it is created could lead to data loss and application instability. It is much better to prevent the creation of unencrypted data in the first place by using the native encryption by default feature.
✗
Configure an S3 Bucket Policy to only allow encrypted EBS snapshots to be uploaded.
Why it's wrong here
EBS volumes and snapshots are not stored in user-accessible S3 buckets in a way that bucket policies can control. EBS is a block storage service, and its encryption is managed through the EC2 service and KMS, not through S3 bucket policies, which are used for object storage security.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

About these practice questions

Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint

Ready to practise?

Start a scored session and see where you stand.

Start practice session

Scored practice sessions

Scored 10-question sessions with instant feedback and explanations.

SCS-C03 Practice Exam 2 — 20 Questions→SCS-C03 Practice Questions 1 — 50 Questions→SCS-C03 Practice Test 2 — 25 Questions→

Practice by domain

Domains are weighted differently on the real exam — spend your time where you score lowest.

Data Protection Detection Identity and Access Management Infrastructure Security

Practice by scenario

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Narrow in on a single topic rather than practising the whole bank at once.

Data Protection practice questions SCS-C03 troubleshooting practice questions Identity and Access Management practice questions Detection practice questions SCS-C03 scenario practice questions

Where to go next

All SCS-C03 questions Exam domains AWS Certified Security - Specialty exam guide

This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.