Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS is retiring this exam on Nov 30, 2026.
Replacement: DVA-C03 Practice Exam
Question 31 of 167
Free Preview · 167 of 554 · questions 1–167 of 554 are free. Sign up free to sync your progress across devices.
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A) Eliminated - While AWS Key Management Service (KMS) keys can be used for encryption in S3 (SSE-KMS), this option refers to creating a custom KMS key, which is not required when using SSE-S3. B) Correct - The x-amz-server-side-encryption header is the correct way to specify the use of SSE-S3 when uploading objects to S3 via the PutObject API. C) Eliminated - Providing an encryption key in the HTTP header refers to client-side encryption or SSE-C D) Eliminated - TLS (Transport Layer Security) encrypts data in transit, not at rest.
==> Discard A: SSE-KMS uses AWS KMS keys, not Amazon S3-managed keys required for SSE-S3. ==> Discard C: SSE-C requires customer-provided keys, not Amazon S3-managed keys for SSE-S3. ==> Discard D: TLS encrypts data in transit, not at rest as required by SSE-S3. B is correct because setting `x-amz-server-side-encryption: AES256` ensures Amazon S3 uses SSE-S3 to encrypt objects at rest automatically.
B is the correct answer.