SAP-C02 AWS KMS Practice Question
A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)
⚠ Common exam trap
The trap here is that candidates often focus solely on either encryption or auditing, failing to recognize that both are required: encryption (KMS) to meet the 'encrypted at rest' requirement and auditing (CloudTrail) to meet the 'audited' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail (C) is correct because it records S3 data events and management events, providing the audit trail required to track who accessed or modified the sensitive objects in the data lake. AWS KMS (D) is correct because it provides customer-managed keys and envelope encryption for S3 objects, satisfying the requirement that data be encrypted at rest with controlled, auditable key usage. SSE-S3 (A) does encrypt objects at rest, but it uses AWS-managed keys with no customer control over key rotation or access policies, so it does not meet the audited key-management requirement. Amazon Macie (B) is a data discovery and classification service that identifies sensitive data but does not itself provide encryption or auditing. Amazon GuardDuty (E) is a threat-detection service that analyzes logs for malicious activity but does not encrypt data or deliver the required audit records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
S3 Server-Side Encryption (SSE-S3)
Why it's wrong here
SSE-S3 encrypts objects with Amazon-managed keys, but it provides no independent audit trail of key usage or access, which the scenario demands. It is tempting because SSE-S3 is the simplest at-rest encryption, and would suit non-sensitive buckets where key management and auditing are not required.
- ✗
Amazon Macie
Why it's wrong here
Macie discovers and classifies sensitive data in S3, but it does not provide the encryption-at-rest mechanism or the audit trail of key usage the scenario demands. It is tempting because classification is genuinely useful for locating sensitive objects, and it would be the right choice when the requirement is data discovery rather than encryption and auditing.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records S3 data-plane and management API activity, including GetObject and PutObject calls, delivering an audit trail of who accessed the sensitive objects and when. This satisfies the stem's auditing requirement, complementing encryption at rest rather than providing it.
- ✓
AWS KMS
Why this is correct
AWS KMS supplies the customer-managed keys that enforce encryption at rest for every S3 object, satisfying the stem's encryption mandate. Its integration with CloudTrail logs each key use, giving the audit trail the scenario demands. SSE-KMS also enables granular key policies and rotation, which bucket-level default encryption alone cannot provide.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty detects malicious activity and anomalous behaviour through threat intelligence feeds, but it neither encrypts S3 objects at rest nor records key-level audit events. It is tempting because it is a security service that surfaces findings, and it would be correct where the requirement is continuous threat detection across accounts rather than encryption and access auditing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.