All new objects in the city’s evidence bucket must be stored with SSE-KMS even when an SDK PutObject omits encryption headers. What should administrators set?
Select an answer to reveal the explanation.
Short Explanation
Bucket default encryption is the city rule on the door: new evidence objects get SSE-KMS even if a rushed Put forgets the headers. Hoping every SDK call remembers is not a control. Public buckets do not magically encrypt.
Full Explanation
S3 bucket default encryption applies a chosen server-side encryption configuration (such as SSE-KMS) to new objects when the Put does not specify otherwise, reducing accidental plaintext-at-rest storage. Depending solely on per-call SDK headers is error-prone. Making a bucket public or deferring encryption to an ad-hoc nightly job is not the correct primary control.