SCS-C02 Infrastructure Security Practice Question
A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. Which feature should they enable on the S3 bucket?
⚠ Common exam trap
SCS-C02 often tests the difference between features that sound security-related (logging, versioning, replication) and the one that actually enforces encryption at rest — candidates frequently pick Server Access Logging or Versioning as a security control when the question asks specifically about encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Default encryption
S3 Default Encryption (now called Default Bucket Encryption) automatically encrypts every object uploaded to the bucket using either SSE-S3 or SSE-KMS, without requiring the uploader to specify encryption headers. Enabling it on the bucket ensures all objects are encrypted at rest by default, satisfying the security team's requirement. It is the only option that directly enforces encryption at rest for all objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Versioning
Why it's wrong here
Versioning preserves multiple versions of an object, allowing you to recover from accidental deletion or overwrite by keeping a history of changes. It is a data lifecycle and availability feature, not an encryption mechanism, because every version is stored exactly as uploaded, including any that were not encrypted. With versioning enabled, an unencrypted object version remains unencrypted, so this feature does not satisfy the requirement to ensure sensitive data is encrypted at rest.
- ✗
Server access logging
Why it's wrong here
Server access logging generates detailed logs that capture each request made to a bucket, including the requester, timestamp, operation, and response status. These logs are valuable for auditing and monitoring access patterns, but they are observational in nature and do not modify the stored objects or apply any encryption. Enabling server access logging has no impact on whether the sensitive data is encrypted at rest; it only records who did what, not how the data is secured.
- ✗
Cross-Region Replication
Why it's wrong here
Cross-Region Replication (CRR) is an asynchronous, automatic copy of objects from a source bucket to a destination bucket in a different AWS region. It duplicates the objects exactly as they exist, meaning an unencrypted source object is copied unencrypted unless you explicitly configure separate encryption keys for the destination. While CRR provides geographic redundancy and disaster recovery, it does not enforce or guarantee encryption at rest; it is a replication feature, not a security control for data protection.
- ✓
Default encryption
Why this is correct
Default encryption automatically applies server-side encryption (SSE-S3, SSE-KMS, or SSE-C) to every new object written to the bucket. This is the correct remediation because it guarantees that all future uploads are encrypted at rest, establishing a consistent security baseline. It is a direct control that addresses the requirement to protect sensitive data, and it can be further enforced with a bucket policy denying unencrypted uploads. Note that default encryption does not encrypt existing objects, so those must be handled separately.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.