SCS-C02 Data Protection Practice Question
A company stores sensitive documents in an S3 bucket. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted using server-side encryption with AWS KMS. Which S3 bucket feature should be configured?
⚠ Common exam trap
SCS-C02 often tests the confusion between access control (bucket policy) and encryption enforcement (default encryption), and candidates may pick bucket policy thinking it encrypts objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Default encryption
S3 default encryption (now called default encryption with SSE-KMS or SSE-S3) automatically encrypts every object at rest when it is uploaded, without requiring the uploader to specify encryption headers. Configuring default encryption with SSE-KMS using a customer-managed KMS key satisfies the requirement for automatic server-side encryption with AWS KMS. This is a bucket-level setting applied at PUT time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Default encryption
Why this is correct
Setting default encryption on the bucket is the correct way to ensure that all objects are encrypted at rest automatically. When enabled, Amazon S3 applies server-side encryption (SSE-S3 by default, or SSE-KMS if configured) to every object uploaded to the bucket, even if the upload request does not include an encryption header. This provides a security baseline for sensitive documents and guarantees that no object is stored in an unencrypted state. Unlike policies or lifecycle rules, default encryption directly acts on the data itself at write time.
- ✗
Versioning
Why it's wrong here
Versioning is a data-protection feature that preserves every version of an object, including overwrites and deletes, so you can recover from accidental modification or deletion. It does not apply any form of encryption to the object data; objects remain stored exactly as uploaded. If an unencrypted object existed before versioning was enabled, that object and all of its versions will continue to be unencrypted. Therefore, versioning cannot be used to satisfy an encryption-at-rest requirement for sensitive documents.
- ✗
Bucket policy
Why it's wrong here
A bucket policy is an IAM-based access control mechanism that defines who can access a bucket and which API actions are permitted. While you can write a policy condition that denies uploads unless the request includes an encryption header (for example, s3:x-amz-server-side-encryption), that only blocks clients that omit the header; it does not encrypt any object itself. A policy also cannot retrofit encryption onto objects that are already stored. Default encryption, by contrast, is a bucket-level setting that actively encrypts all incoming objects regardless of the client's behavior.
- ✗
Lifecycle policy
Why it's wrong here
Lifecycle policies are used to automate the management of objects' storage lifecycles, such as transitioning objects to S3 Standard-IA or S3 Glacier after a certain number of days, or expiring objects entirely. These actions do not change whether an object is encrypted; a lifecycle policy neither adds encryption to unencrypted objects nor removes encryption from encrypted ones. If an object is uploaded without encryption, a lifecycle rule cannot encrypt it retroactively. Thus, lifecycle policies are irrelevant to ensuring that sensitive documents are encrypted at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.