SCS-C02 Server-Side Encryption (SSE) Practice Question
A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?
⚠ Common exam trap
Candidates often confuse auditing (Access Logs) or deletion protection (MFA Delete) with data protection mechanisms. The question specifically asks for protecting data at rest and in transit, which are encryption and transport enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy that denies requests without aws:SecureTransport
Enforcing HTTPS (aws:SecureTransport) protects data in transit by requiring all requests to use TLS. Option D is correct because enabling default encryption (SSE-S3 or SSE-KMS) ensures data at rest is automatically encrypted when written to S3. Option A is incorrect: S3 Access Logs are for auditing access, not for protecting data. Option C is incorrect: MFA Delete protects against accidental deletion, not data protection at rest or in transit. Option E is incorrect: pre-signed URLs provide time-limited access but do not inherently protect data at rest or enforce encryption in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Access Logs and send them to a separate account
Why it's wrong here
Access Logs record who requested which objects after the fact; they provide auditing, not encryption at rest or in transit. They are tempting because logging is a recognised S3 security control, but the required actions are SSE-KMS default encryption and a policy enforcing TLS-only access.
- ✓
Add a bucket policy that denies requests without aws:SecureTransport
Why this is correct
Denying requests lacking `aws:SecureTransport` enforces TLS on every S3 API call, satisfying the in-transit encryption requirement. The condition evaluates the transport protocol of each request, so any IAM user or role attempting plain HTTP access is rejected regardless of identity permissions. This protects sensitive documents during transmission without altering stored object encryption.
- ✗
Enable MFA Delete on the S3 bucket
Why it's wrong here
MFA Delete only guards version deletion and permanent object removal; it provides no encryption at rest and no transport protection. It is tempting because it hardens the bucket against accidental or malicious deletion, but the question asks for data protection at rest and in transit.
- ✓
Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS
Why this is correct
SSE-S3 or SSE-KMS encrypts every object at rest automatically, satisfying the data-at-rest requirement without per-object effort. SSE-KMS adds customer-managed key control and CloudTrail auditability of key usage, which suits sensitive documents accessed by multiple IAM principals. Server-side encryption is transparent to callers, so existing access patterns remain unchanged.
- ✗
Use pre-signed URLs for all access
Why it's wrong here
Pre-signed URLs delegate temporary access to a single object; they neither encrypt data at rest nor enforce TLS in transit. They are tempting because they restrict who can fetch an object, but the required actions are SSE-KMS encryption and a bucket policy denying requests where aws:SecureTransport is false.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.