DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  SSE-C

  Why this is correct

  SSE-C lets you provide your own encryption keys in every request, and S3 performs the encryption/decryption as objects are written/read. The keys are not stored by AWS; S3 holds only a salted HMAC of the key for validation, so you must supply the raw key on every operation. This meets a customer-managed key requirement while still being server-side encryption.

• ✗

  Client-side encryption

  Why it's wrong here

  Client-side encryption is performed in your application before the object is ever uploaded, so S3 receives only ciphertext and has no access to the plaintext or the encryption keys. It is not server-side encryption at rest because the encryption happens outside S3, meaning you are responsible for key management and the SDK libraries. If the requirement is specifically for S3 to encrypt data at rest, this option does not satisfy it.

• ✓

  SSE-KMS

  Why this is correct

  SSE-KMS uses AWS Key Management Service to generate and manage your CMKs, letting you control key rotation, grants, and audit trails. It is a fully supported server-side encryption option for S3, but the key is AWS-managed (or customer-managed in KMS) rather than provided by you in the S3 request. This option gives you KMS features, but not the same direct key control as SSE-C.

• ✓

  SSE-S3

  Why this is correct

  SSE-S3 is S3's default server-side encryption, where Amazon S3 manages the encryption keys for you using strong AES-256 encryption. It requires no extra configuration, but you cannot see, rotate, or provide your own keys. If your requirement demands customer-supplied keys, SSE-S3 does not meet it because the keys are entirely owned and managed by AWS.

• ✗

  AWS CloudHSM

  Why it's wrong here

  CloudHSM is a dedicated hardware security module in your VPC, not a native S3 encryption mode. S3 does not have an integration that uses CloudHSM directly for server-side encryption, so it would require you to build a separate encryption layer. It is therefore not an appropriate choice when you need a built-in S3 server-side encryption setting.