Quick Answer

The answer is to enable default encryption with SSE-KMS using the customer-managed key, configure an S3 bucket policy denying access outside the corporate IP range, and attach an S3 VPC endpoint policy restricting access to the corporate VPC. This combination ensures S3 encryption at rest with a customer-managed KMS key that supports automatic 90-day rotation, while the network restriction prevents data exposure from outside the corporate network, except for approved AWS services that can use the VPC endpoint. On the SAA-C03 exam, this scenario tests your understanding of layered security—combining encryption controls with network-level policies—and often appears as a multi-step configuration question. A common trap is confusing bucket policies with VPC endpoint policies; remember that the bucket policy denies by IP, while the endpoint policy allows only from the VPC. Memory tip: “Encrypt with KMS, deny by IP, allow by endpoint.”