SAA-C03 Question 216

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Option B uses AWS tools like S3 Default Encryption, Inventory, and Batch Operations to enable encryption for both existing and future objects with minimal effort and automation, making it the best solution. Why not the other options? A. Create a new S3 bucket and migrate objects: This involves downloading and re-uploading all objects, which is highly manual, time-consuming, and prone to errors. It also incurs additional data transfer costs. C. Use SSE-KMS and turn on versioning: While enabling SSE-KMS for future objects is valid, this does not encrypt the existing objects unless explicitly copied or rewritten, requiring additional manual effort. D. Browse and modify objects manually: Manually selecting and encrypting each object is impractical for a bucket with millions of objects, as it is labor-intensive and time-consuming.

• Chose B4

  to be fair all these options take a hell a lot of work to do but i think the least amount of effort is B. https://aws.amazon.com/blogs/storage/encrypting-objects-with-amazon-s3-batch-operations/

• Chose B3

  A - Extreme amount of effort B - Should work C - SSE-KMS is not "least amount of effort" compared to SSE-S3; Turning versioning is not required to achieve the result but on the contrary, it will cause the non-encrypted files to remain as old versions even if you encrypt them in the future. D - Even more effort as A