SCS-C02 Management and Security Governance Practice Question
A security engineer is designing a solution to protect sensitive data in S3. Which THREE mechanisms can be used to enforce encryption at rest?
⚠ Common exam trap
Watch out — candidates often confuse cross-region replication (which copies encrypted objects but does not enforce encryption) with an encryption enforcement mechanism, or they think MFA Delete relates to encryption at rest when it only protects against deletion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP to deny s3:PutObject without encryption
An SCP (Service Control Policy) can be applied at the organizational level to deny any s3:PutObject action that does not include encryption parameters. This enforces encryption at rest across all accounts in the organization, preventing users from uploading unencrypted objects regardless of individual bucket policies or default encryption settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an SCP to deny s3:PutObject without encryption
Why this is correct
An SCP is an organization-level policy that can restrict IAM actions across all accounts in an OU. By adding a deny condition that requires the s3:x-amz-server-side-encryption key to be present for s3:PutObject, the SCP effectively blocks any unencrypted upload to S3 in the selected accounts, regardless of IAM permissions. This is a preventive control that cannot be overridden by individual bucket policies or IAM users, providing centralized enforcement for sensitive data.
- ✓
Enable default encryption on the S3 bucket
Why this is correct
Enabling default encryption on an S3 bucket automatically applies SSE-S3 or SSE-KMS to any object uploaded without an explicit encryption header. It guarantees that all stored objects are encrypted at rest, even if the client forgets to specify encryption, but it does not reject unencrypted upload requests—it silently encrypts them. This is a simpler, bucket-level safeguard that ensures data confidentiality without requiring changes to client code.
- ✗
Enable cross-region replication
Why it's wrong here
CRR replicates objects to a destination bucket in a different AWS Region, offering geographic redundancy and lower latency for data access. It does not, however, enforce or add encryption to the objects being replicated; if the source object is stored in clear text, the replica in the destination bucket will also be clear text unless the destination bucket has separate default encryption configured. Replication is about availability and disaster recovery, not confidentiality or encryption enforcement.
- ✓
Apply a bucket policy that denies PutObject without the x-amz-server-side-encryption header
Why this is correct
This bucket policy uses a condition key like s3:x-amz-server-side-encryption to deny s3:PutObject if the header does not include a valid encryption algorithm (e.g., AES256 or aws:kms). The policy is evaluated at the resource level and rejects the upload entirely with an Access Denied error, forcing clients to explicitly request encryption in the API call. It is a strong, per-bucket enforcement mechanism, but it can break clients that rely on server-side default encryption, since they may not send the header.
- ✗
Enable MFA Delete on the S3 bucket
Why it's wrong here
MFA Delete requires the caller to present a valid multi-factor authentication token when deleting an object version or changing the bucket's Versioning configuration. It protects data integrity and prevents accidental or malicious deletions, but it has no effect on how objects are encrypted or whether encryption is required. Therefore, it does not address the requirement to protect sensitive data via encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.