SAP-C02 Design for New Solutions Practice Question
A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?
⚠ Common exam trap
It's easy for candidates to confuse S3 server access logs (which are log files delivered to an S3 bucket) with CloudTrail data events, or assume SSE-S3 meets the 'customer-managed keys' requirement because it is a form of server-side encryption, but SSE-S3 uses AWS-owned keys, not customer-managed ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.
It uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.
Why it's wrong here
SSE-S3 not customer-managed; server access logs do not capture KMS operations.
- ✓
Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.
Why this is correct
Customer-managed key meets requirement; CloudTrail audits access.
- ✗
Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.
Why it's wrong here
SSE-S3 uses AWS-managed keys, not customer-managed.
- ✗
Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.
Why it's wrong here
Client-side encryption is not server-side; CloudWatch logs are not for auditing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is building a data lake on Amazon S3. The data comes from various sources and must be encrypted at rest. The security policy requires that the encryption keys be managed by the company and rotated annually. Which TWO solutions meet these requirements? (Choose two.)
easy- ✓ A.Use server-side encryption with customer-provided keys (SSE-C)
- B.Use server-side encryption with S3 managed keys (SSE-S3)
- ✓ C.Use server-side encryption with AWS KMS managed keys (SSE-KMS) with a customer managed key
- D.Enable default encryption on the S3 bucket with SSE-S3
- E.Use client-side encryption with the Amazon S3 encryption client
Why A: Server-side encryption with customer-provided keys (SSE-C) allows the company to provide and manage their own encryption keys, including annual rotation. Server-side encryption with AWS KMS using a customer managed key (SSE-KMS) also lets the company manage keys through KMS and set up automatic annual rotation. Client-side encryption with the Amazon S3 encryption client encrypts data before it is sent to S3, ensuring encryption at rest with keys managed entirely by the company, and the company can rotate the keys as needed. All three options (A, C, and E) meet the requirements for encryption at rest with company-managed keys and annual rotation. Although the stem specifies 'Choose two,' these three are valid; any two can be selected as correct answers.
Variation 2. A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?
hard- A.Use S3 server-side encryption with customer-provided keys (SSE-C) and implement a Lambda function to rotate keys every 90 days.
- B.Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 server access logs.
- C.Use S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and enable automatic key rotation every 90 days. Enable AWS CloudTrail for KMS key usage logging.
- ✓ D.Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.
Why D: Meets all requirements with the least operational overhead. Client-side encryption with the AWS Encryption SDK ensures data is encrypted at rest. Keys are stored in AWS Secrets Manager, which supports automatic rotation on a custom 90-day schedule. CloudTrail logs all Secrets Manager API calls, providing an audit trail of key usage. Option A requires custom Lambda code for rotation. Option B uses SSE-S3, which cannot be rotated on a 90-day schedule and lacks key usage audit. Option C uses SSE-KMS, but automatic rotation for customer managed keys is fixed at 365 days, failing the 90-day requirement.
Variation 3. A company is designing a new data lake on Amazon S3. The data must be encrypted at rest using envelope encryption with AWS KMS. The company wants to use an AWS managed key that rotates annually. Which TWO components are required for this design? (Choose TWO.)
hard- ✓ A.AWS KMS data key
- B.AWS KMS customer managed key
- C.AWS Certificate Manager
- D.AWS CloudHSM
- ✓ E.Amazon S3 bucket with SSE-KMS enabled
Why A: For envelope encryption with an AWS managed key that rotates annually, the required components are the S3 bucket with SSE-KMS enabled to use KMS for encryption at rest, and the AWS KMS data key which is used to encrypt the data before storing. The AWS managed KMS key itself is also required but is not listed as an option; the closest listed component is the customer managed key (Option B), but that does not meet the requirement of using an AWS managed key. Therefore, only options A and E are correct from the given choices.
Variation 4. A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)
medium- ✓ A.Enable default encryption with SSE-KMS on the S3 bucket.
- B.Use client-side encryption before uploading to S3.
- C.Enable S3 server access logging.
- D.Use a bucket ACL to grant access to the data lake.
- ✓ E.Configure an S3 bucket policy that allows access only from specific IAM roles.
Why A: Options A and E are correct. A: Enabling default encryption with SSE-KMS ensures data is encrypted at rest using AWS Key Management Service, providing control over encryption keys. E: A bucket policy that allows access only from specific IAM roles ensures only authorized users can access the data, following the principle of least privilege. Option B (client-side encryption) is not required as server-side encryption meets the requirement. Option C (server access logging) does not control access or encryption. Option D (bucket ACL) is less secure and not recommended for controlling access compared to IAM policies.
Variation 5. A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?
hard- A.Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.
- B.Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.
- ✓ C.Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.
- D.Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.
Why C: When using an AWS KMS CMK from a different account (Account B) for SSE-KMS on an S3 bucket in Account A, you must explicitly grant Account A access to the key via the KMS key policy in Account B. Additionally, the S3 bucket policy in Account A must allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 will use these permissions to encrypt and decrypt objects on behalf of the bucket owner. Without both policy updates, the cross-account KMS operation will fail with an access denied error.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.