ANS-C01 SSE-S3 Practice Question
A company is using AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that only authorized users can access them. Which combination of actions should they take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.
Enabling default encryption (SSE-S3) on the S3 bucket ensures logs are encrypted at rest. Attaching a bucket policy that restricts access to authorized IAM principals ensures only authorized users can access them. This combination fully satisfies both requirements. Option A (SSE-KMS with a customer managed key) encrypts the logs at rest, but it does not include the access controls needed to ensure only authorized users can access the logs—additional measures would be required. Option B (disable public access and enable versioning) does not encrypt the logs. Option D (SSE-C) is impractical for CloudTrail logs because it requires you to supply encryption keys with every API call and does not inherently restrict access. Therefore, option C is the correct combination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SSE-KMS with a customer managed key and allow CloudTrail to use the key.
Why it's wrong here
Using SSE-KMS with a customer managed key does not, by itself, enforce access control on the log files; it only encrypts them. The stem requires that *only authorised users can access* the logs, which demands an IAM resource-based policy on the S3 bucket, not merely encryption. This option is tempting because SSE-KMS is the standard method for meeting encryption-at-rest compliance, and it would be correct if the question asked solely about encryption without the access-control requirement.
- ✗
Disable public access to the S3 bucket and enable versioning.
Why it's wrong here
This does not encrypt the logs; encryption must be enabled separately.
- ✓
Enable default encryption (SSE-S3) on the S3 bucket and attach a bucket policy that restricts access to authorized IAM principals.
Why this is correct
SSE-S3 encrypts logs at rest, and bucket policy controls access.
- ✗
Enable SSE-C on the S3 bucket and provide the encryption key in each API call.
Why it's wrong here
SSE-C requires the client to provide the key; CloudTrail cannot do that.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.