ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Encryption / Question 2

CLF-C02 practice question: Encryption (2 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A developer's upload script writes new objects to an Amazon S3 bucket and sets no encryption options.

The compliance team wants every object encrypted at rest, without changing the script and without adding cost.

Which statement is accurate?

Choose one answer.

  1. A. S3 stores the object unencrypted until the bucket owner separately turns on default encryption
  2. B. S3 rejects the upload, because a request that does not name an AWS KMS key is always refused
  3. C. S3 encrypts the object with SSE-S3 by default at no extra charge, so the script is unchanged
  4. D. S3 encrypts the object with SSE-KMS by default, which adds AWS KMS request and key charges to uploads
Show the answer and explanation

Answer: C

  • A. Wrong: Since January 5, 2023, S3 encrypts all new uploads automatically, so no bucket setting is needed for new objects to be encrypted.
  • B. Wrong: Uploads do not need to name a key. With no encryption options, S3 applies its default encryption, so the upload succeeds.
  • C. Right: Correct. All new S3 uploads are encrypted with SSE-S3 by default, and that encryption has no additional charge. Storage and requests are still billed as usual. Learn more: Default encryption FAQ for Amazon S3 (opens in a new tab)
  • D. Wrong: SSE-KMS is an option the team can choose, but it is not the default. The default for new uploads is SSE-S3, which has no additional charge.

Explanation

Starting January 5, 2023, Amazon S3 encrypts every new object with SSE-S3 by default, at no additional charge and with no change to applications. Teams that need control over the key can choose SSE-KMS for the bucket, which adds AWS KMS charges. Encryption in transit is a separate matter and uses HTTPS.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice EncryptionAll Encryption questions

Want more on Encryption? The 5 full-length practice sets have 10 more Encryption questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets