DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SSE-S3

  Why it's wrong here

  SSE-S3 encrypts objects with keys managed entirely by AWS. While it provides encryption at rest, customers have no direct control over the encryption keys themselves, as AWS handles key generation, storage, and rotation automatically. This option does not meet a requirement for using a customer-managed KMS key, as the keys are fully AWS-managed and not exposed for customer management.

• ✓

  SSE-KMS

  Why this is correct

  SSE-KMS utilizes AWS Key Management Service (KMS) to manage encryption keys, allowing customers to use either AWS-managed KMS keys or customer-managed keys (CMKs). This method provides a robust audit trail through AWS CloudTrail for key usage and enables granular access control policies on the keys themselves. It directly supports the requirement for customer-managed encryption keys by integrating with KMS, offering control over key lifecycle and permissions.

• ✗

  SSE-C

  Why it's wrong here

  SSE-C involves the customer providing their own encryption key with each S3 request for both object uploads and downloads. Although the key is customer-provided, AWS does not store, manage, or integrate these keys with KMS for lifecycle management, rotation, or auditing. This approach differs significantly from using a customer-managed KMS key, as the key management burden remains entirely with the customer outside of AWS's key management infrastructure.

• ✗

  Client-side encryption

  Why it's wrong here

  Client-side encryption means data is encrypted by the application before it is sent to Amazon S3. S3 receives and stores the data as an already encrypted blob, without performing any server-side encryption operations or interacting with KMS for key management. This method does not leverage S3's server-side encryption features and places the entire encryption and key management responsibility on the client application, making it distinct from server-side options.