SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use SSE-S3 with the default Amazon-managed key for all uploads.

  Why it's wrong here

  SSE-S3 encrypts each object at rest with a unique data key that is itself protected by an Amazon-managed root key. While this protects against physical compromise of S3 storage, AWS fully controls the key rotation and lifecycle, leaving no ability for the security team to set key policies, issue grants, or audit key usage through CloudTrail. If a suspected compromise occurs, you cannot disable this key to immediately block access—all objects would need to be deleted manually, and any cached copies remain readable. Because the requirement explicitly states the security team must control and revoke keys, the default Amazon-managed key is insufficient.

  When this WOULD be correct

  A question that requires server-side encryption with minimal management overhead and no need for customer key control or quick key disabling, e.g., 'A company wants to encrypt all S3 objects by default with no additional cost or key management burden.'

• ✓

  Use SSE-KMS with a customer-managed AWS KMS key.

  Why this is correct

  SSE-KMS with a customer-managed KMS key gives the security team explicit control over key policy, grants, auditing, and revocation. The application can upload objects normally while S3 handles encryption and decryption on the service side, so developers do not need custom cryptography code. If compromise is suspected, the key or grants can be disabled to block future access, which is exactly why a customer-managed key is preferable here.

• ✗

  Encrypt objects on the client side and store the encryption key in the same S3 bucket.

  Why it's wrong here

  Client-side encryption with the key stored in the same S3 bucket completely nullifies the value of encryption, since an attacker with read access to the bucket can retrieve both the ciphertext and the decryption key. This approach also forces the application to manage and synchronize key material in a location that is itself targeted, while developer teams must implement and maintain custom cryptographic code. Storing a key alongside its data is a fundamental security anti-pattern; credentials or keys should reside in a hardened service like AWS KMS or Secrets Manager. This option both fails the key-control requirement and weakens the overall security posture.

  When this WOULD be correct

  This option would be correct if the requirement was that data must be encrypted before it reaches AWS (e.g., for compliance with data sovereignty laws) and the application team is willing to manage encryption logic, but they want to store the key separately (e.g., in AWS Secrets Manager or a different bucket with strict access controls).

• ✗

  Use Amazon S3 replication to a second bucket in another region.

  Why it's wrong here

  S3 replication duplicates objects across regions for durability and disaster recovery, but it does not alter the encryption mechanism or key management of the source objects. Since replication copies the object as-is, any unencrypted or weakly encrypted data remains that way unless you separately adjust the destination bucket's encryption settings. Moreover, replicating data to a second region actually multiplies copies, making it harder to revoke or secure data in an incident. Replication alone gives the security team no control over encryption keys, so this solution fails the stated requirement.

  When this WOULD be correct

  A question requiring cross-region disaster recovery or compliance with data residency requirements, where the goal is to automatically replicate objects to a bucket in another region for redundancy, without specific encryption control or access revocation needs.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question