SAP-C02 Design for New Solutions Practice Question
A company is designing a data lake on AWS using Amazon S3. The data lake will store sensitive customer data that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which solution meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse SSE-KMS with customer managed keys as meeting the 'own HSM' requirement, but KMS is a shared service and does not provide a dedicated HSM under the customer's exclusive control, unlike CloudHSM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use client-side encryption with keys stored in AWS CloudHSM and rotate the keys using CloudHSM key rotation
The company requires encryption keys to be managed by its own HSM and rotated every 90 days. AWS CloudHSM provides a dedicated HSM appliance that the customer fully controls, and client-side encryption ensures that the encryption keys never leave the customer's HSM environment. The customer can implement key rotation within CloudHSM using its native key management capabilities, meeting both the HSM control and 90-day rotation requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SSE-S3 (Amazon S3 managed keys) and configure a lifecycle policy to re-encrypt objects every 90 days
Why it's wrong here
SSE-S3 uses S3-managed keys; you cannot manage or rotate the keys yourself.
- ✗
Use SSE-KMS with a customer managed key and configure automatic key rotation every 90 days
Why it's wrong here
KMS customer managed keys can be rotated, but the keys are managed by AWS, not your own HSM.
- ✓
Use client-side encryption with keys stored in AWS CloudHSM and rotate the keys using CloudHSM key rotation
Why this is correct
CloudHSM provides dedicated HSMs under your control. You can store keys in CloudHSM and rotate them as needed.
- ✗
Use SSE-C (customer-provided keys) and provide the key with each PUT request, rotating the key every 90 days
Why it's wrong here
SSE-C requires you to provide the encryption key with each request, which is not practical for automatic rotation and requires significant application changes.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.