SCS-C02 Data Protection Practice Question
Network Topology
The above CLI output shows the encryption configuration for an S3 bucket. What type of encryption is enabled by default?
⚠ Common exam trap
SCS-C02 often tests the confusion between SSE-S3 and SSE-KMS by showing CLI output with 'AES256' and expecting candidates to recognize it as the S3-managed default rather than assuming KMS is always used for sensitive data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSE-S3
SSE-S3 (AES-256) is the default encryption applied by Amazon S3 when no explicit encryption configuration is set on a bucket. The CLI output showing 'ApplyServerSideEncryptionByDefault' with 'SSEAlgorithm: AES256' indicates SSE-S3, where S3 manages the keys entirely. SSE-KMS would show 'aws:kms' and a KMS key ARN, while SSE-C requires customer-provided keys per request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSE-C
Why it's wrong here
SSE-C uses customer-provided encryption keys supplied with each individual object upload, not an AWS-managed key. The CLI output would need to show per-request encryption parameters such as x-amz-server-side-encryption-customer-algorithm and key headers, and S3 default bucket encryption cannot be set to SSE-C because it is not a persistent bucket-level configuration. The absence of any customer key material or per-request encryption settings in the output rules out SSE-C.
- ✗
Client-side encryption
Why it's wrong here
Client-side encryption occurs before data is ever sent to Amazon S3, with the client application encrypting the object and managing the keys itself; S3 only receives ciphertext. A bucket encryption CLI output, such as from get-bucket-encryption, describes the server-side encryption behavior that S3 applies at write time, not any client-side process. Since the output is showing a server-side encryption configuration, client-side encryption is not a valid interpretation.
- ✗
SSE-KMS
Why it's wrong here
SSE-KMS is indicated by an SSEAlgorithm value of 'aws:kms' in the bucket encryption configuration, and it normally includes additional fields like KMSMasterKeyID or a KMS key ARN, and optionally BucketKeyEnabled. The CLI output instead shows only the value 'AES256', which is the algorithm identifier used by SSE-S3, not the 'aws:kms' algorithm used by SSE-KMS. With SSE-KMS, S3 invokes AWS KMS for encryption and decryption operations, which would be reflected in the configuration output, but no such KMS-specific details are present.
- ✓
SSE-S3
Why this is correct
The CLI output shows SSEAlgorithm set to 'AES256', which is the exact algorithm identifier that Amazon S3 uses to represent SSE-S3 in a bucket default encryption configuration. With SSE-S3, S3 automatically manages all encryption keys, encrypts each object with a unique key, and wraps that key with a regularly rotated master key, requiring no customer action or KMS involvement. This precisely matches the output shown, confirming that the bucket is configured for SSE-S3.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.