CLF-C02 Security and Compliance Practice Question
A company must encrypt all data at rest stored in Amazon S3 and wants AWS to manage the encryption keys. Which S3 encryption option requires the least operational overhead?
⚠ Common exam trap
Many candidates confuse 'AWS managed keys' with SSE-KMS, assuming KMS is the default AWS-managed option, but SSE-S3 is the true fully managed key service with zero configuration overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSE-S3 (Amazon S3-Managed Keys)
SSE-S3 uses Amazon S3-managed keys, where AWS fully handles key creation, management, and rotation with no configuration required from the user. This option provides the least operational overhead because you simply enable server-side encryption on the bucket or object, and AWS manages the entire encryption process transparently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSE-C (Customer-Provided Keys)
Why it's wrong here
SSE-C (Customer-Provided Keys) is server-side encryption, but it demands that you supply your own encryption key with every S3 API request via request headers. S3 uses that key to encrypt or decrypt the object and then discards it, so you must manage, store, and repeatedly provide the correct key for every operation, including reads and writes. This creates maximum operational overhead—key rotation, secure storage, and strict per-request key handling—and is therefore the wrong answer when the requirement is to avoid key management entirely.
- ✗
SSE-KMS (AWS KMS-Managed Keys)
Why it's wrong here
SSE-KMS (AWS KMS-Managed Keys) is server-side encryption, but it introduces manual KMS key management and per-request API charges each time an object is encrypted or decrypted. It uses envelope encryption, generating a data key and calling KMS operations, which adds latency and requires IAM permissions to be configured. For a scenario demanding zero operational overhead, SSE-KMS is unnecessarily involved compared to SSE-S3, making it the wrong choice even though it offers enhanced control and auditability.
- ✓
SSE-S3 (Amazon S3-Managed Keys)
Why this is correct
SSE-S3 (Amazon S3-Managed Keys) is the correct answer because it provides transparent, fully-managed server-side encryption with no customer key management or additional costs. AWS automatically encrypts each object with a unique key, then encrypts that key with a rotating master key, all entirely on the server side. It is the default encryption mechanism when you enable the bucket default encryption setting, requiring no code, no key storage, and no per-request API fees, making it the ideal zero-overhead encryption option.
- ✗
Client-side encryption
Why it's wrong here
Client-side encryption requires your application to encrypt data before uploading it to S3 and decrypt it after downloading, meaning AWS never sees the plaintext or your encryption keys. You must implement and maintain the encryption logic, manage the cryptographic keys (e.g., in AWS KMS or a local key store), and handle algorithm versioning, which drastically increases complexity. Unlike server-side encryption, it also bypasses S3 features that rely on plaintext access, such as object indexing and certain integrations, so it is the most invasive and operationally heavy approach.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.