SAA-C03 Design Secure Architectures Practice Question
A startup is deploying a new web application on AWS. The security team wants to ensure that all data stored in Amazon S3 is encrypted at rest and that the company retains full control over the encryption keys, including the ability to audit key usage and rotate keys on demand. The team also wants to minimize the operational burden of managing key infrastructure. Which S3 encryption option should a solutions architect recommend?
⚠ Common exam trap
The trap here is equating encryption at rest with key control, when only customer managed KMS keys provide auditable, policy-controlled, rotatable keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with AWS KMS customer managed keys (SSE-KMS).
SSE-KMS with customer managed keys provides encryption at rest while giving the company control over key policies, rotation, and auditing via CloudTrail. AWS handles the key infrastructure, so operational burden stays low. SSE-S3 offers no customer key control, SSE-C requires per-request key management, and client-side encryption shifts significant complexity to the application, making SSE-KMS the appropriate choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client-side encryption with a key stored in AWS Secrets Manager.
Why it's wrong here
Client-side encryption requires the application to encrypt data before uploading and manage the encryption process, increasing development and operational complexity. While Secrets Manager can store the key, the company must still handle key rotation, cipher selection, and error handling. This approach does not leverage S3's native encryption integration and adds more burden than SSE-KMS, which meets the requirements more efficiently.
- ✗
Server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
SSE-C requires the application to supply the encryption key with every request, and AWS does not store the key. While this gives the customer control, it places a significant operational burden on the application to manage, protect, and rotate keys. It also does not provide integrated auditing of key usage through AWS KMS. The requirement to minimize operational burden makes SSE-C a poor fit.
- ✗
Server-side encryption with Amazon S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 encrypts objects at rest, but the keys are fully managed by AWS and the customer has no control over rotation or key policies and cannot audit individual key usage. The requirement explicitly states that the company must retain full control over keys, including auditing and on-demand rotation. SSE-S3 does not provide that level of control, so it does not meet the stated requirements.
- ✓
Server-side encryption with AWS KMS customer managed keys (SSE-KMS).
Why this is correct
SSE-KMS with customer managed keys lets the company define key policies, enable automatic annual rotation, and audit every use of the key through AWS CloudTrail. AWS manages the underlying key infrastructure, so operational burden is low. This satisfies the requirements for control, auditing, and on-demand rotation while keeping management overhead minimal, making it the best fit for the scenario.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 935 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.