SAA-C03 Design Secure Architectures Practice Question
A startup stores application configuration files in an Amazon S3 bucket. The security team wants to ensure that objects in the bucket are encrypted at rest with keys that the company manages and can rotate on its own schedule. Which S3 encryption option should a solutions architect choose?
⚠ Common exam trap
The trap here is assuming SSE-S3 allows customer-controlled rotation, when SSE-S3 keys are fully managed by AWS and cannot be rotated on a customer-defined schedule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with AWS KMS keys (SSE-KMS) using a customer managed key.
SSE-KMS with a customer managed key gives the company ownership of the key policy, the ability to enable and schedule automatic key rotation, and CloudTrail visibility into key usage. The other S3 encryption options either leave key management to AWS, require the application to supply keys per request, or move encryption entirely to the client, none of which matches the requirement for company-managed, rotatable keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Server-side encryption with AWS KMS keys (SSE-KMS) using a customer managed key.
Why this is correct
SSE-KMS with a customer managed key lets the company control the key policy, define who can use the key, and configure automatic key rotation on a schedule the company chooses. This meets the requirement for company-managed keys with controllable rotation, and it also provides an audit trail of key usage through AWS CloudTrail, which is valuable for compliance.
- ✗
Server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
SSE-C requires the application to supply the encryption key on every request and AWS does not store it, so S3 cannot perform automatic rotation on the company's behalf. The company would have to manage rotation entirely outside AWS and update every client, which adds operational burden. It also does not provide the centralized key policy and audit features of KMS.
- ✗
Client-side encryption with an AWS KMS key before uploading objects to the bucket.
Why it's wrong here
Client-side encryption means the application encrypts data before sending it to S3, so the objects are stored as opaque ciphertext. While the company controls the keys, S3 cannot enforce encryption at rest, manage rotation, or provide the same integrated key management and access control that SSE-KMS offers. It also pushes key handling complexity into every client.
- ✗
Server-side encryption with Amazon S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 encrypts objects with keys fully managed by Amazon S3, including rotation handled automatically by AWS. The company has no visibility into or control over the key, cannot set a custom rotation schedule, and cannot apply a key policy. This does not satisfy the requirement for keys the company manages and rotates on its own schedule.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 935-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.