Courseiva
← SAA-C03
Full test
Question 399 of 1,040
Design Secure Architectures →easyMultiple ChoiceObjective-mapped

Quick Answer

The answer is kms:GenerateDataKey. This is the most directly required KMS permission for an S3 PutObject operation using SSE-KMS because when S3 encrypts an object with a customer-managed KMS key, it does not directly use the KMS key to encrypt the data; instead, it calls KMS to generate a unique data key, using the plaintext version to encrypt the object and storing the encrypted version alongside it. On the SAA-C03 exam, this concept tests your understanding of how S3 integrates with KMS during uploads—a common trap is confusing kms:Decrypt or kms:Encrypt with the actual permission needed, but remember that encryption happens via a generated data key, not by directly encrypting the object with the KMS key. A useful memory tip: "Generate before you encrypt"—the role must have kms:GenerateDataKey to create the key that does the actual encryption.

SAA-C03 Design Secure Architectures Practice Question

This SAA-C03 practice question tests your understanding of design secure architectures. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

An S3 bucket uses a customer-managed KMS key as the default for SSE-KMS encryption. A service role will upload objects using s3:PutObject. Assuming the role already has permission to write to the bucket, which KMS permission is most directly required for the role to let S3 encrypt the object during upload?

Question 1easymultiple choice
Full question →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

kms:GenerateDataKey (and optionally kms:DescribeKey)

When S3 uses SSE-KMS with a customer-managed KMS key, the service calls KMS to generate a data key for encrypting the object. The s3:PutObject operation requires the caller to have kms:GenerateDataKey permission on the KMS key so that S3 can obtain the plaintext and encrypted versions of the data key. Optionally, kms:DescribeKey may be needed for S3 to verify the key exists, but kms:GenerateDataKey is the most directly required permission.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    kms:GenerateDataKey (and optionally kms:DescribeKey)

    Why this is correct

    For SSE-KMS uploads, S3 uses KMS to generate a data key for encrypting the object. kms:GenerateDataKey is the direct permission required for that flow. kms:DescribeKey can be useful for validation or troubleshooting, but it is not the core cryptographic permission.

    Related concept

    Read the scenario before looking for a memorised answer.

  • ✗

    kms:Decrypt only

    Why it's wrong here

    kms:Decrypt is primarily needed when reading objects back and KMS must decrypt the data key material. It is not the direct permission required to encrypt the object during upload.

  • ✗

    kms:CreateAlias and kms:UpdateAlias only

    Why it's wrong here

    Alias management controls how a key is referenced, but it does not allow S3 to generate data keys or encrypt object data.

  • ✗

    kms:ScheduleKeyDeletion and kms:CancelKeyDeletion only

    Why it's wrong here

    These are administrative lifecycle permissions for the KMS key and do not support SSE-KMS encryption during upload.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse kms:Decrypt (needed for GET/read operations) with kms:GenerateDataKey (needed for PUT/write operations), or they assume any KMS permission will work because S3 handles encryption transparently.

Detailed technical explanation

How to think about this question

Under the hood, when S3 receives a PutObject request with SSE-KMS, it calls KMS's GenerateDataKey API to get a unique data key. S3 uses the plaintext data key to encrypt the object client-side (within S3's infrastructure), then discards the plaintext and stores only the encrypted data key alongside the object. This means the IAM role must have kms:GenerateDataKey on the specific KMS key ARN, and the key policy must also grant this permission to the role.

KKey Concepts to Remember

  • Read the scenario before looking for a memorised answer.
  • Find the constraint that changes the correct option.
  • Eliminate answers that are true in general but not in this case.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related practice questions

Related SAA-C03 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Design Secure Architectures practice questions

Practise SAA-C03 questions linked to Design Secure Architectures.

Design Resilient Architectures practice questions

Practise SAA-C03 questions linked to Design Resilient Architectures.

Design High-Performing Architectures practice questions

Practise SAA-C03 questions linked to Design High-Performing Architectures.

Design Cost-Optimized Architectures practice questions

Practise SAA-C03 questions linked to Design Cost-Optimized Architectures.

SAA-C03 VPC practice questions

Practise SAA-C03 questions linked to SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAA-C03 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

Practise SAA-C03 questions linked to SAA-C03 RDS Multi-AZ questions.

SAA-C03 IAM policy practice questions

Practise SAA-C03 questions linked to SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Practise SAA-C03 questions linked to SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAA-C03 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Practise SAA-C03 questions linked to SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

Practise SAA-C03 questions linked to SAA-C03 VPC endpoint questions.

Practice this exam

Start a free SAA-C03 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
SAA-C03 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SAA-C03 question test?

Design Secure Architectures — This question tests Design Secure Architectures — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: kms:GenerateDataKey (and optionally kms:DescribeKey) — When S3 uses SSE-KMS with a customer-managed KMS key, the service calls KMS to generate a data key for encrypting the object. The s3:PutObject operation requires the caller to have kms:GenerateDataKey permission on the KMS key so that S3 can obtain the plaintext and encrypted versions of the data key. Optionally, kms:DescribeKey may be needed for S3 to verify the key exists, but kms:GenerateDataKey is the most directly required permission.

What should I do if I get this SAA-C03 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More SAA-C03 practice questions

Browse all SAA-C03 questions →

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.