DVA-C02 Security Practice Question
A developer needs to encrypt data at rest in an Amazon S3 bucket. Which THREE options are available for server-side encryption?
⚠ Common exam trap
DVA-C02 often tests the boundary between server-side and client-side encryption — candidates who pick 'Client-side encryption' as an S3 SSE option miss that SSE by definition means AWS performs encryption after receiving the data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSE-C
SSE-C (option A) is a valid server-side encryption option where the customer supplies their own encryption keys to S3, and S3 performs the encryption/decryption on the server side while the customer retains the keys. SSE-KMS (option C) is correct because S3 uses AWS KMS customer master keys (CMKs) to generate and manage the data keys used for server-side encryption, giving audit and control benefits. SSE-S3 (option D) is also correct because S3 fully manages the encryption keys with AES-256, providing server-side encryption without any key management effort from the customer. Option B (client-side encryption) is not a server-side option since the data is encrypted before it reaches S3, and option E (AWS CloudHSM) is a hardware security module service, not an S3 server-side encryption mode, although it can be used indirectly with SSE-C or custom key management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSE-C
Why this is correct
SSE-C lets you provide your own encryption keys in every request, and S3 performs the encryption/decryption as objects are written/read. The keys are not stored by AWS; S3 holds only a salted HMAC of the key for validation, so you must supply the raw key on every operation. This meets a customer-managed key requirement while still being server-side encryption.
- ✗
Client-side encryption
Why it's wrong here
Client-side encryption is performed in your application before the object is ever uploaded, so S3 receives only ciphertext and has no access to the plaintext or the encryption keys. It is not server-side encryption at rest because the encryption happens outside S3, meaning you are responsible for key management and the SDK libraries. If the requirement is specifically for S3 to encrypt data at rest, this option does not satisfy it.
- ✓
SSE-KMS
Why this is correct
SSE-KMS uses AWS Key Management Service to generate and manage your CMKs, letting you control key rotation, grants, and audit trails. It is a fully supported server-side encryption option for S3, but the key is AWS-managed (or customer-managed in KMS) rather than provided by you in the S3 request. This option gives you KMS features, but not the same direct key control as SSE-C.
- ✓
SSE-S3
Why this is correct
SSE-S3 is S3's default server-side encryption, where Amazon S3 manages the encryption keys for you using strong AES-256 encryption. It requires no extra configuration, but you cannot see, rotate, or provide your own keys. If your requirement demands customer-supplied keys, SSE-S3 does not meet it because the keys are entirely owned and managed by AWS.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM is a dedicated hardware security module in your VPC, not a native S3 encryption mode. S3 does not have an integration that uses CloudHSM directly for server-side encryption, so it would require you to build a separate encryption layer. It is therefore not an appropriate choice when you need a built-in S3 server-side encryption setting.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.