SAA-C03 Design Secure Architectures Practice Question

A media company stores its video uploads in an Amazon S3 bucket. The security team wants to ensure that any objects uploaded to the bucket are encrypted at rest using keys managed in AWS Key Management Service (AWS KMS) and that the encryption key is rotated annually. Which solution should a solutions architect recommend?

⚠ Common exam trap

The trap here is assuming that any encryption method satisfies a KMS-specific requirement, when only SSE-KMS with a customer managed key provides the required key management and rotation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key configured for annual rotation.

Using SSE-KMS with a customer managed key satisfies both the encryption at rest requirement and the annual key rotation requirement. S3 default encryption automatically applies the chosen encryption method to all new objects, ensuring consistent protection without relying on upload headers. This approach provides the necessary control over the encryption keys.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key configured for annual rotation.
Why this is correct
SSE-KMS with a customer managed key allows you to control the KMS key, and you can enable automatic key rotation with a period of one year. This meets the requirement for encryption at rest using KMS keys and annual rotation. S3 default encryption ensures all new objects are encrypted automatically.
✗
Configure a bucket policy that denies uploads unless the request includes the x-amz-server-side-encryption header with the value AES256.
Why it's wrong here
The AES256 header enforces SSE-S3, not SSE-KMS. While this can enforce encryption, it uses S3-managed keys and does not involve AWS KMS or key rotation. The scenario requires KMS-managed keys with annual rotation, so this policy does not satisfy the requirement.
✗
Enable default encryption on the S3 bucket using SSE-S3.
Why it's wrong here
SSE-S3 uses Amazon S3-managed keys and does not provide KMS key rotation or the ability to manage keys in AWS KMS. The requirement explicitly asks for KMS-managed keys with annual rotation. SSE-S3 encrypts objects but does not meet the key management and rotation control needed here.
✗
Use S3 server access logs to verify that objects are encrypted with a KMS key.
Why it's wrong here
Server access logs record requests made to the bucket; they do not enforce or configure encryption. They cannot ensure objects are encrypted with a specific KMS key or manage key rotation. This option does not provide the required encryption at rest or key rotation.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question