S3 Encryption with SSE-KMS and Automatic Key Rotation
A data engineer is designing a data lake on Amazon S3. The data consists of sensitive personally identifiable information (PII) that must be encrypted at rest. The company requires that encryption keys be rotated every 90 days and that access to the keys be logged. Which encryption solution meets these requirements?
Quick Answer
The correct answer is to use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation. This solution satisfies all requirements because SSE-KMS encrypts sensitive PII at rest in S3 using a customer master key managed by AWS Key Management Service, and enabling automatic key rotation ensures the key is rotated every 90 days as mandated by the company policy. Additionally, every use of the KMS key is logged in AWS CloudTrail, providing the necessary access logging for auditing. On the AWS Certified Data Engineer Associate DEA-C01 exam, this scenario tests your understanding of how to combine encryption, compliance-driven rotation schedules, and auditability without resorting to external key management or client-side encryption—a common trap is choosing SSE-S3, which lacks rotation control and logging granularity. Remember the memory tip: “SSE-KMS gives you logs and rotates, SSE-S3 just encrypts and waits.”
⚠ Common exam trap
Test-takers frequently confuse SSE-S3's automatic annual rotation with the required 90-day rotation, or assume SSE-C or client-side encryption can meet logging and rotation requirements without realizing they lack native AWS rotation and auditing capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation.
SSE-KMS with automatic key rotation (Option D) meets the requirements because it encrypts data at rest in S3, allows key rotation every 90 days via AWS KMS automatic rotation, and logs all key usage in AWS CloudTrail for auditing. This provides the necessary encryption, rotation, and access logging without managing keys externally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
SSE-C requires the customer to provide keys with each request and does not support automatic rotation.
- ✗
Use client-side encryption with a master key stored in AWS Secrets Manager.
Why it's wrong here
Client-side encryption shifts key management to the client; AWS does not control rotation.
- ✗
Use server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 does not support key rotation or detailed access logging.
- ✓
Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation.
Why this is correct
SSE-KMS provides customer-managed keys with rotation and logging via CloudTrail.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is designing a data lake on Amazon S3. The data includes customer PII that must be encrypted at rest. The company also requires that the encryption keys be rotated automatically every year. Which encryption solution should the engineer use?
easy- ✓ A.SSE-KMS with automatic key rotation enabled
- B.SSE-S3
- C.SSE-C
- D.Client-side encryption with AWS KMS
Why A: SSE-KMS with automatic key rotation enabled meets both requirements: it encrypts data at rest in S3 and allows the company to automatically rotate the customer master key (CMK) every year. AWS KMS supports automatic annual rotation for symmetric CMKs, which satisfies the compliance need without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.