SAP-C02 Question 51

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  You can enforce encryption on PutObject but not on GetObject. Objects are automatically decrypted on retrieval if you have KMS permissions.

• Chose B1

  Answer A uses SSE-S3 (still an AWS managed key, which does not meet the requirements). Answer C is incorrect because there is no bucket policy that automatically encrypts when GetObject is used. Answer D is confused about terminology (AES-256 is the algorithm, not the customer managed key).

• Chose A1

  A. In the S3 bucket properties, change the default encryption to SSE-S3 with a customer managed key. Use the AWS CLI to re-upload all objects in the S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests. Here's why: Requirements Recap: All current and future objects must be encrypted using customer-managed keys. The current encryption is SSE-S3, which uses S3-managed keys, not customer-managed keys. The bucket does not have versioning enabled, so overwriting (re-uploading) is necessary to change encryption on existing objects.