SAA-C03 Design Secure Architectures Practice Question

A company stores sensitive data in an Amazon S3 bucket. The security team must ensure that all data is encrypted at rest using a customer managed AWS KMS key (CMK) and that the key's usage is auditable. They also need to be able to rotate the key annually. Which solution meets these requirements?

⚠ Common exam trap

The trap here is thinking that SSE-S3 or SSE-C can use a customer managed CMK; only SSE-KMS supports KMS keys.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use server-side encryption with AWS KMS (SSE-KMS) with a customer managed CMK and enable automatic key rotation.

SSE-KMS with a customer managed CMK provides encryption at rest using a key that the customer controls. AWS KMS integrates with CloudTrail to log key usage, enabling auditing. Automatic key rotation can be enabled for the CMK, rotating the backing key annually. This solution meets all specified requirements: encryption with a CMK, auditability, and rotation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable versioning on the bucket.
Why it's wrong here
SSE-S3 uses encryption keys managed by Amazon S3, not a customer managed CMK. It does not provide the ability to audit key usage through AWS CloudTrail in the same way as a CMK, nor does it support customer-controlled key rotation. The requirement specifies a customer managed CMK, so SSE-S3 does not meet the need.
✓
Use server-side encryption with AWS KMS (SSE-KMS) with a customer managed CMK and enable automatic key rotation.
Why this is correct
SSE-KMS with a customer managed CMK allows the company to control the key, audit its usage via CloudTrail, and configure automatic annual rotation. This meets all requirements: encryption at rest with a CMK, auditability, and key rotation. The CMK policy can also restrict access to authorized principals, enhancing security.
✗
Use server-side encryption with customer-provided keys (SSE-C) and rotate the keys manually every year.
Why it's wrong here
SSE-C requires the customer to provide and manage the encryption keys, and AWS does not store them. This does not use a KMS CMK, and key rotation is manual. Auditing key usage is also not integrated with CloudTrail. The requirement for a customer managed CMK and auditable usage is not satisfied by SSE-C.
✗
Use client-side encryption with a customer-provided key stored in AWS Secrets Manager.
Why it's wrong here
Client-side encryption encrypts data before uploading to S3, but the key management is the customer's responsibility. While Secrets Manager can store the key, this approach does not use a KMS CMK for encryption at rest in S3. It also lacks the integrated auditability and automatic rotation features of KMS. The requirement specifically asks for a customer managed CMK, so this does not meet it.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question