A company must guarantee that every object uploaded to an S3 bucket is stored encrypted. Which of the following will enforce encryption for uploads? (Choose two.)

Enabling Amazon S3 default encryption ensures that all new objects uploaded to the bucket are automatically encrypted at rest, even if the upload request does not specify encryption. This is a straightforward and effective way to enforce encryption. Creating an S3 bucket policy that rejects upload requests without encryption (e.g., without the x-amz-server-side-encryption header) is another robust method. This policy explicitly denies uploads that do not meet the encryption requirement, preventing unencrypted objects from ever being stored. AWS Shield is a DDoS protection service and does not enforce S3 object encryption. Object ACLs control access permissions, not encryption requirements. Amazon Inspector is a security assessment service that scans for vulnerabilities, but it does not prevent or enforce encryption during the upload process.