SCS-C02 Data Protection Practice Question
A company needs to encrypt data in transit between an on-premises data center and Amazon S3. Which solution should they use?
⚠ Common exam trap
Test-takers frequently confuse encryption at rest (KMS) with encryption in transit, or assume that network-level features like VPC endpoints or Transfer Acceleration inherently provide encryption, when in fact they do not add transport-layer security beyond what HTTPS already provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use HTTPS endpoints for S3 API calls.
HTTPS (HTTP over TLS) encrypts data in transit between the on-premises data center and Amazon S3 by using TLS 1.2/1.3 to secure the API calls. This ensures that all data transmitted over the network is encrypted end-to-end, protecting it from eavesdropping and man-in-the-middle attacks. AWS S3 enforces HTTPS for all API requests when using the default endpoint, and customers can also configure bucket policies to deny HTTP requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS KMS to encrypt the data before transmission.
Why it's wrong here
AWS KMS is a key management service that generates and encrypts data keys for envelope encryption, but it does not itself encrypt data in transit. Using KMS to encrypt data before transmission would require additional client-side encryption logic and still leaves the API communication unprotected unless you also use TLS. KMS does not establish or negotiate a secure transport session between on-premises clients and S3.
- ✗
Use an S3 VPC endpoint.
Why it's wrong here
An S3 VPC endpoint provides a private network path from your VPC to S3 without traversing the public internet, but it does not encrypt the traffic flowing over that path. The endpoint simply routes requests through AWS's private network, and the data remains in plaintext at the transport layer unless you explicitly use HTTPS. Therefore, a VPC endpoint cannot satisfy the requirement to encrypt data in transit.
- ✓
Use HTTPS endpoints for S3 API calls.
Why this is correct
HTTPS endpoints for S3 API calls use Transport Layer Security (TLS) to encrypt the entire HTTP request and response payload between the on-premises client and the S3 service. This protects the confidentiality and integrity of data in transit, preventing eavesdropping and tampering. Using HTTPS is the standard, built-in mechanism for securing S3 API traffic, and it applies regardless of whether the client is in your VPC or on-premises.
- ✗
Use S3 Transfer Acceleration.
Why it's wrong here
S3 Transfer Acceleration is a performance feature that uses Amazon CloudFront's edge locations and optimized network paths to reduce latency for large uploads. While Transfer Acceleration requires you to use HTTPS endpoints for the accelerated upload, it does not provide any additional encryption beyond what plain HTTPS already offers. Its purpose is to speed up transfer, not to secure data in transit, so it cannot be the primary answer to an encryption requirement.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.