SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS KMS to require encryption in transit

  Why it's wrong here

  AWS KMS manages envelope encryption keys for data at rest (e.g., SSE-KMS) and does not participate in the TLS handshake or otherwise control how a client communicates with S3 over the network. Even if you use KMS to encrypt objects, a client can still upload or download those objects over plain HTTP, because KMS only protects the ciphertext stored on disk. To enforce encryption in transit, you must explicitly reject non-HTTPS requests at the S3 API layer using a bucket policy condition such as aws:SecureTransport.

• ✗

  Enable S3 Transfer Acceleration

  Why it's wrong here

  S3 Transfer Acceleration is a performance feature that uses AWS edge locations to speed up uploads over long distances, but it does not change the underlying S3 API protocol or add any security requirements. It continues to accept the same HTTP or HTTPS requests, so a client can still send unencrypted traffic to the accelerated endpoint. It is not a substitute for a bucket policy that denies non-SecureTransport requests, and enabling it would leave the bucket vulnerable to plaintext transit.

• ✓

  Add a bucket policy that denies requests where aws:SecureTransport is false

  Why this is correct

  Adding a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` enforces HTTPS by rejecting any HTTP or unencrypted requests at the S3 API level. This satisfies the stem’s requirement to ensure encryption is enforced for data in transit, as the policy explicitly blocks non-HTTPS traffic regardless of the client’s protocol choice.

• ✗

  Use Amazon CloudFront with HTTPS only

  Why it's wrong here

  Amazon CloudFront can be configured to enforce HTTPS for viewer (client) connections, but the S3 origin bucket remains directly addressable over HTTP unless you explicitly restrict access with an origin access control and bucket policy. CloudFront acts as an edge proxy, so it only protects traffic between the client and CloudFront; the bucket itself will still accept HTTP requests from other clients or even bypass the distribution entirely. A bucket policy denying aws:SecureTransport=false is required to guarantee that every request to the bucket, regardless of path, uses TLS.

Go deeper

Related to this question