DVA-C02 Security Practice Question

A company wants to encrypt data at rest in an S3 bucket using server-side encryption. Which option provides the MOST control over the encryption key?

⚠ Common exam trap

Candidates often confuse 'most control' with 'easiest management' and pick SSE-KMS, but the question explicitly asks for the option that provides the MOST control over the encryption key, which is SSE-C because you own and manage the key entirely.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SSE-C (customer-provided keys)

SSE-C (customer-provided keys) gives you the most control because you manage the encryption key yourself—you provide the key in each request, and AWS discards it after use. This means you have full lifecycle control over the key material, including rotation, deletion, and access policies, without AWS ever storing the key. In contrast, SSE-KMS and SSE-S3 rely on AWS-managed or AWS-controlled key stores, reducing your direct control.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SSE-KMS (AWS KMS keys)
Why it's wrong here
While SSE-KMS leverages AWS Key Management Service (KMS) for managing encryption keys, AWS still maintains control over the master key lifecycle and audit trails within KMS. Customers define access policies for their KMS keys, but they do not directly provide or manage the specific data encryption key used by S3 for object encryption. This means the customer does not have full, direct custody or management of the encryption key itself, unlike SSE-C.
✓
SSE-C (customer-provided keys)
Why this is correct
SSE-C (Server-Side Encryption with Customer-Provided Keys) mandates that the customer supply their unique encryption key with every PUT and GET request to S3. Amazon S3 uses this key solely for encrypting or decrypting the object data and then immediately discards it, never storing the key itself. This method provides the highest level of customer control over the encryption key's generation, storage, rotation, and lifecycle, as AWS never retains custody of the key.
✗
Client-side encryption
Why it's wrong here
Client-side encryption involves encrypting data on the application or client device *before* it is transmitted to Amazon S3. While this approach ensures data is encrypted in transit and at rest within S3, the encryption process itself does not occur on the S3 server. The question specifically asks about server-side encryption performed by S3, making client-side encryption an incorrect choice for that particular requirement.
✗
SSE-S3 (S3-managed keys)
Why it's wrong here
SSE-S3 utilizes encryption keys that are entirely managed by Amazon S3, employing AES-256 encryption. S3 automatically handles the creation, rotation, and protection of these keys without any customer intervention or management. Although it provides robust encryption at rest, customers have no direct control or visibility into the lifecycle or storage of these S3-managed encryption keys, which does not align with a requirement for customer key management.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DVA-C02 Security Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question