MLS-C01 Data Engineering Practice Question
A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest with a key that is automatically rotated every year. Which solution meets these requirements with the least operational overhead?
⚠ Common exam trap
The trap here is that candidates often overthink and choose SSE-KMS with customer-managed keys because they associate 'customer-managed' with more control, but the question explicitly asks for the least operational overhead, which SSE-S3 provides by eliminating all key management tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SSE-S3 (Amazon S3-managed keys)
SSE-S3 uses Amazon S3-managed keys (AES-256) that are automatically rotated annually by AWS, meeting the encryption-at-rest and automatic rotation requirements with zero operational overhead. This is the simplest option because no key management or rotation configuration is needed from the customer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SSE-KMS with a customer-managed key and automatic rotation
Why it's wrong here
While KMS supports automatic rotation, SSE-S3 has less overhead.
- ✗
Use SSE-C (customer-provided keys)
Why it's wrong here
SSE-C requires the customer to manage keys, not automatic rotation.
- ✓
Use SSE-S3 (Amazon S3-managed keys)
Why this is correct
SSE-S3 automatically rotates keys and requires no customer management.
- ✗
Use SSE-KMS with a customer-managed key and manual rotation
Why it's wrong here
Manual rotation adds operational overhead.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.