DVA-C02 Security Practice Question
A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?
⚠ Common exam trap
Test-takers frequently confuse the role of the CMK and the data key, mistakenly thinking the CMK directly encrypts the object (Option B), or they assume key rotation triggers re-encryption of existing data (Option C), when in fact envelope encryption decouples the key rotation from the stored ciphertext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.
AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.
Why this is correct
This statement accurately describes AWS KMS envelope encryption, which is the standard mechanism for encrypting data in Amazon S3 using KMS. The Customer Master Key (CMK) never directly encrypts the large object data; instead, it is used to generate and encrypt a unique data key. This data key then performs the actual encryption of the S3 object, and its encrypted form is securely stored alongside the object within its metadata, enabling decryption later.
- ✗
The CMK directly encrypts the object data.
Why it's wrong here
This option is incorrect because AWS KMS CMKs are designed for encrypting small amounts of data, such as data keys, not directly encrypting large data objects like S3 files. Direct encryption of object data by a CMK would be inefficient, slow, and exceed the operational limits of KMS. Instead, KMS employs envelope encryption, where the CMK encrypts a data key, and that data key then encrypts the actual object data.
- ✗
When the CMK is rotated, all existing objects in the bucket are automatically re-encrypted with the new key.
Why it's wrong here
This statement is incorrect as automatic CMK rotation in AWS KMS only applies to new cryptographic operations. When a CMK is rotated, existing objects encrypted with that CMK are not automatically re-encrypted with the new key material. They remain encrypted with the original data key, which was itself encrypted by the CMK's previous key material. Decryption operations will automatically use the correct key version.
- ✗
Each object is encrypted with a unique data key that is stored alongside the object.
Why it's wrong here
While it is true that each object is typically encrypted with a unique data key for enhanced security, the statement's description of storage is imprecise and incomplete. The *encrypted* data key, not the plaintext data key, is stored *within* the object's metadata, not merely 'alongside' as a separate, potentially exposed entity. Storing the plaintext data key alongside the object would compromise its security, defeating the purpose of KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.