SAA-C03 Design Secure Architectures Practice Question
An enterprise requires all data stored in Amazon S3 to be encrypted at rest. The security team must maintain full control over the encryption keys, including the ability to rotate them annually and define access policies for the keys themselves. Which encryption method meets these requirements with the least operational overhead?
⚠ Common exam trap
SAA-C03 often tests the confusion between SSE-S3, SSE-KMS, and SSE-C, particularly regarding who manages the keys and the level of control provided.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS).
SSE-KMS with Customer Managed Keys (CMKs) allows the security team to create and manage their own KMS keys, including setting key policies, rotating keys annually, and auditing key usage via CloudTrail. It provides full control over the encryption keys while offloading the encryption/decryption process to S3, minimizing operational overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) for all buckets.
Why it's wrong here
Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) uses the AES-256 algorithm to protect data at rest. While this is the simplest method to implement, it does not allow for granular key management or provide the security team with the control needed to audit specific key usage.
- ✗
Implement client-side encryption using a third-party library before uploading objects.
Why it's wrong here
Client-side encryption ensures data is encrypted before it leaves the application environment, but it places a heavy management burden on the development team. This method is highly secure but significantly increases architectural complexity and makes it difficult for the security team to centrally manage and rotate keys.
- ✓
Use Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS).
Why this is correct
Using SSE-KMS with a Customer Managed Key (CMK) allows the security team to define specific key policies and manage rotation schedules independently. This solution ensures that the security team retains ownership of the cryptographic material while providing the necessary encryption for objects stored within the S3 bucket.
- ✗
Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) for all uploads.
Why it's wrong here
SSE-C requires the customer to manage the encryption keys and provide them with every request to S3. While this offers maximum control, it introduces significant operational overhead and risk, as the customer is entirely responsible for the secure storage and availability of the keys outside of AWS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 149 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.