DVA-C02 SSE-KMS Practice Question
A developer is designing a system to store sensitive user data in Amazon S3. The data must be encrypted at rest and the encryption keys must be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)
⚠ Common exam trap
It's easy for candidates to confuse AWS KMS with AWS CloudHSM, thinking both support automatic key rotation, but CloudHSM requires manual rotation and lacks native S3 integration for SSE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon S3 SSE-KMS
Option A (Amazon S3 SSE-KMS) is correct because server-side encryption with AWS KMS keys (SSE-KMS) encrypts objects at rest in S3 and supports automatic annual key rotation when the underlying KMS customer managed key has rotation enabled. Option D (AWS KMS) is correct because it is the service that creates and manages the customer managed keys used for encryption and provides built-in annual automatic key rotation (every 365 days) for symmetric KMS keys. Option B (AWS Secrets Manager) is not for encrypting S3 object data at rest; it stores and rotates secrets such as database credentials. Option C (AWS Certificate Manager) manages TLS/SSL certificates for encryption in transit, not S3 data-at-rest encryption keys. Option E (AWS CloudHSM) provides dedicated hardware security modules and does not by itself deliver S3 at-rest encryption with annual key rotation as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon S3 SSE-KMS
Why this is correct
SSE-KMS encrypts S3 objects at rest using AWS KMS customer managed keys, and KMS supports automatic annual key rotation, satisfying both the encryption and rotation requirements. It is the server-side option that keeps key management within KMS.
- ✗
AWS Secrets Manager
Why it's wrong here
Incorrect: AWS Secrets Manager is for storing and rotating secrets (e.g., database credentials), not for encrypting S3 data at rest.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM issues and renews TLS certificates for transport encryption; it neither encrypts S3 objects at rest nor manages data encryption keys with annual rotation. It is tempting because ACM handles key material, and would be correct for securing HTTPS endpoints, not object storage.
- ✓
AWS KMS
Why this is correct
AWS KMS provides server-side encryption with customer managed keys that support automatic annual rotation, meeting both the encryption-at-rest and key-rotation requirements. It integrates directly with S3 SSE-KMS, so no custom key management code is needed.
- ✗
AWS CloudHSM
Why it's wrong here
Incorrect: AWS CloudHSM provides hardware security modules but does not natively integrate with S3 SSE and does not support automatic key rotation.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.