AWS Managed Encryption Keys: KMS for Data at Rest and in Transit
A company is designing a new application that will process sensitive financial data. The application must encrypt data at rest and in transit. The company wants to use AWS managed keys for encryption. Which AWS service should the company use to create and manage the encryption keys?
Quick Answer
The answer is AWS Key Management Service (KMS), the correct choice because it is the dedicated, fully managed service for creating and controlling AWS managed encryption keys used to encrypt data both at rest and in transit. KMS employs envelope encryption, where a customer master key (CMK) protects data keys that perform the actual encryption, and it integrates natively with services like S3, EBS, and RDS to enforce encryption policies seamlessly. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this question tests your ability to distinguish between KMS and other encryption services like CloudHSM or ACM; a common trap is confusing KMS with CloudHSM, but remember that KMS provides managed keys with automatic rotation and IAM-based access control, whereas CloudHSM gives you dedicated hardware for regulatory compliance. Memory tip: KMS is the “key master” for AWS—if you need managed, integrated key creation and rotation for data at rest and in transit, think KMS first.
⚠ Common exam trap
Test-takers frequently confuse AWS CloudHSM (which provides dedicated, customer-managed HSMs) with KMS (which provides fully managed, AWS-controlled keys), leading them to choose CloudHSM when the question explicitly requires 'AWS managed keys'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is the correct choice because it is a managed service that enables you to create, store, and control encryption keys used to encrypt data at rest and in transit. KMS integrates with other AWS services (e.g., S3, EBS, RDS) and supports envelope encryption, where a customer master key (CMK) encrypts data keys that perform the actual encryption. It also provides automatic key rotation and fine-grained access control via IAM policies and key policies, meeting the requirement for AWS-managed keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM provides dedicated hardware but requires more management than KMS.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager stores secrets, but does not create or manage encryption keys.
- ✓
AWS Key Management Service (KMS)
Why this is correct
KMS is a fully managed service for creating and controlling encryption keys.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM manages SSL/TLS certificates, not encryption keys for data at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?
medium- A.Use Amazon S3 with server-side encryption and enforce HTTPS.
- B.Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.
- C.Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.
- ✓ D.Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.
Why D: It addresses both encryption requirements: EBS encryption ensures data at rest is encrypted using AWS KMS-managed keys, and configuring the application to use TLS encrypts data in transit between clients and the EC2 instances. This combination directly meets the stated security needs without relying on external services like S3 or ACM for the EC2-hosted application.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.