SCS-C02 Data Protection Practice Question
Which TWO methods can be used to encrypt data at rest in Amazon S3? (Choose 2.)
⚠ Common exam trap
The trap here is conflating encryption in transit (HTTPS) or access controls (bucket policies, MFA Delete) with encryption at rest — candidates must recognize that only SSE variants and client-side encryption actually encrypt stored data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SSE-S3 to have Amazon S3 manage the encryption keys.
Option B is correct because SSE-S3 (server-side encryption with Amazon S3-managed keys, AES-256) encrypts objects at rest, with AWS fully managing the key material and rotation. Option E is correct because client-side encryption means data is encrypted before it leaves the client and is stored in S3 already encrypted, so the objects are protected at rest. Option A is not a valid answer because a bucket policy denying unencrypted uploads only enforces that encryption is used; it does not itself encrypt data. Option C is incorrect because HTTPS/TLS provides encryption in transit, not at rest. Option D is incorrect because MFA Delete only adds an authentication requirement for deleting objects or changing versioning state; it does not encrypt data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a bucket policy that denies uploads without encryption.
Why it's wrong here
A bucket policy that denies uploads without encryption is an enforcement control, not an encryption mechanism. The policy can require clients to include encryption headers like x-amz-server-side-encryption on PUT requests, but it only governs future writes. Objects already stored or objects uploaded in violation of the policy are not automatically encrypted, and the policy itself does not transform plaintext data into ciphertext at rest.
- ✓
Use SSE-S3 to have Amazon S3 manage the encryption keys.
Why this is correct
SSE-S3 (Server-Side Encryption with Amazon S3-managed keys) encrypts each object using AES-256 with a unique key, and that key is then protected by a regularly rotated master key owned by S3. When enabled, S3 automatically encrypts data as it writes to disk and decrypts it transparently on retrieval, with no additional key management burden for the customer. This is a fully managed, low-overhead method for encrypting data at rest in S3.
- ✗
Enable encryption in transit using HTTPS.
Why it's wrong here
Enabling encryption in transit with HTTPS protects data using TLS while it travels between the client and S3, preventing eavesdropping and tampering during network transfer. However, TLS does not apply to the data once it is stored on S3's servers; the ciphertext exists only in the communication channel, not on the underlying storage volumes. Therefore, HTTPS is a transport-layer control and cannot satisfy at-rest encryption requirements.
- ✗
Enable MFA Delete on the S3 bucket.
Why it's wrong here
Enabling MFA Delete on an S3 bucket requires a multi-factor authentication code to permanently delete an object version or suspend versioning, which guards against accidental or malicious deletions. This is a versioning feature that bolsters data durability and integrity, but it has no effect on the confidentiality of object contents. Objects remain in plaintext on disk unless a separate encryption method, such as SSE-S3 or client-side encryption, is applied.
- ✓
Encrypt the objects client-side before uploading to S3.
Why this is correct
Client-side encryption fully encrypts objects before they are uploaded to S3, using encryption keys that you manage, for example via AWS KMS or your own key infrastructure. S3 receives only ciphertext, so the data is unreadable at rest even if server-side encryption is not configured on the bucket. This approach gives you complete control over key management, encryption algorithms, and envelope encryption, making it a valid method for protecting data at rest in S3.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.