SAP-C02 Question 90

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Current Setup: Two AWS accounts (1 per business unit), under a single AWS Organization. Each account has its own S3 bucket. Buckets replicate data between each other. Buckets have millions of objects. SSE is not enabled. New Requirement: Use SSE-S3 (Amazon S3-managed encryption keys, not SSE-KMS). Must encrypt existing objects as well (not just new ones). Needs to be operationally efficient. The most operationally efficient way to enable encryption at rest with SSE-S3 on existing S3 buckets containing millions of objects is to enable SSE-S3 on the buckets and use S3 Batch Operations to copy the objects in place, which triggers automatic encryption during the copy.

• 2

  This is outdated now. "Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Starting January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance." https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html

• Chose A1

  S3 Batch Operations can be used to efficiently apply changes to a large number of objects in a bucket, including copying and encrypting them in place. This is ideal for retroactively encrypting millions of existing objects without needing to manually handle them one by one.