Exams / CLF-C02 / Encryption / Question 2
CLF-C02 practice question: Encryption (2 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A developer uploads a new object to an Amazon S3 bucket without specifying any encryption settings. What happens to the object?
Choose one answer.
- AA. It is stored unencrypted until the developer enables encryption on the bucket.
- BB. It is encrypted only if the bucket is in a Region that requires encryption by law.
- CC. The upload is rejected because every request must name a KMS key.
- DD. It is encrypted at rest automatically with S3 managed keys (SSE-S3) at no extra cost.
Show the answer and explanation
Answer: D
- A. Wrong: Since January 2023 S3 encrypts every new object upload automatically, and this cannot be turned off for new uploads.
- B. Wrong: Default encryption applies in all Regions. It does not depend on local regulations.
- C. Wrong: Uploads do not need to name a key. S3 applies server-side encryption with S3 managed keys by default.
- D. Right: Correct. All new uploads are encrypted with SSE-S3 by default, with no additional charge and no change needed to applications.
Explanation
Amazon S3 now encrypts all new objects at rest by default using server-side encryption with Amazon S3 managed keys (SSE-S3, AES-256), at no extra cost. Customers can choose SSE-KMS instead when they need control over the key and its policy. Encryption in transit is separate and is provided by using HTTPS (TLS) connections.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.