SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable default encryption on each S3 bucket and create a CloudWatch alarm to notify if unencrypted objects are uploaded.

  Why it's wrong here

  Default encryption on an S3 bucket transparently encrypts objects at rest after the PUT completes, but it does not inspect or reject an incoming request that lacks encryption headers. A CloudWatch alarm can only notify you after the fact about objects that were already stored, leaving a window where unencrypted data exists and failing to enforce encryption as a precondition for the write operation. This approach is detective, not preventive, so it does not satisfy the requirement to ensure all uploads are encrypted from the start.

• ✗

  Use an S3 bucket policy with a Deny statement for s3:PutObject without encryption applied to all buckets via a single policy.

  Why it's wrong here

  Bucket policies are scoped to a single bucket and cannot be applied globally across multiple buckets in one statement. While you could attach a similar Deny policy to each bucket individually, the option specifically claims a single policy covers all buckets, which is incorrect because an S3 bucket policy has no cross-bucket or organizational application mechanism. Additionally, the Deny condition would need to check for the x-amz-server-side-encryption header (or require aws:SecureTransport-like conditions), but the fundamental flaw is the policy's inability to be global without per-bucket deployment.

• ✗

  Use AWS CloudTrail to monitor PutObject calls and trigger an AWS Lambda function to delete unencrypted objects.

  Why it's wrong here

  CloudTrail logs PutObject API calls, so it can record whether an object was uploaded without encryption, but it does not intercept or block the request at write time. Invoking a Lambda function to delete unencrypted objects after the fact is a destructive, reactive measure that risks data loss and race conditions, and it does not guarantee that unencrypted data never exists in the bucket. This option provides audit visibility but fails the requirement to proactively enforce encryption on every upload.

• ✓

  Use an S3 bucket policy on each bucket that denies s3:PutObject if the x-amz-server-side-encryption header is not present.

  Why this is correct

  A bucket policy with a Deny for s3:PutObject when the x-amz-server-side-encryption header is absent enforces encryption at upload time by rejecting the request before any object is written. The condition evaluates the presence of the encryption header (e.g., using StringNotEquals if s3:x-amz-server-side-encryption is not AES256 or aws:kms), and this applies to every PutObject on that bucket. Because each bucket needs its own policy, the administrator must attach the policy to every bucket individually, but this fully satisfies the enforcement requirement.

Go deeper

Related to this question