Attach an S3 bucket policy that rejects PutObject requests missing the x-amz-server-side-encryption header is correct because it enforces encryption at upload and prevents any PutObject request that does not include the required server side encryption header from being accepted.

A deny bucket policy can require the request to include the header x-amz-server-side-encryption with values such as AES256 or aws:kms and it is evaluated during the request so unencrypted uploads are refused before S3 stores the object. This real time enforcement guarantees that only objects uploaded with server side encryption are accepted into the bucket.

Enable default bucket encryption using SSE-S3 on the Amazon S3 bucket configures a default encryption method for objects stored without a specified encryption option and it helps protect data at rest but it does not by itself require clients to send the encryption header and it does not block noncompliant uploads at request time.

Use the AWS Config managed rule s3-bucket-server-side-encryption-enabled to detect noncompliant uploads provides detection and optional automated remediation after an object exists and it cannot prevent a nonencrypted PutObject request from succeeding at upload time.

Create an Amazon CloudWatch alarm that alerts when unencrypted objects are added to the bucket only provides notification and visibility and it does not enforce encryption or stop uploads when the write occurs.

Full AWS Practitioner Certification Question