S3 Encryption at Rest: Choosing the Right Option
A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)
⚠ Common exam trap
Test-takers frequently confuse SSL/TLS certificates (which are just cryptographic containers) with the actual encryption protocol (TLS), and they mistakenly think ACM or IAM directly perform encryption instead of managing certificates or access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TLS for all data in transit
Transport Layer Security encrypts data moving between clients and servers, protecting sensitive financial data from interception or tampering over the network. Option D (AWS Key Management Service (KMS) for encryption at rest) is correct because KMS lets the company create and manage customer master keys used to encrypt stored data, such as EBS volumes, S3 objects, and RDS databases, satisfying the encryption-at-rest requirement. Option B is not correct because AWS Certificate Manager only provisions, manages, and deploys TLS/SSL certificates; it does not itself perform encryption of data at rest or in transit. Option C is not correct because SSL is a deprecated predecessor to TLS, and simply having certificates does not guarantee encryption is enforced on all connections. Option E is not correct because IAM controls authentication and authorization to AWS resources; it does not encrypt data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TLS for all data in transit
Why this is correct
TLS encrypts data in transit between clients and services, directly satisfying the in-transit encryption requirement for sensitive financial data. It protects against interception on the network, complementing at-rest encryption. Selecting TLS alongside a KMS-based at-rest control fulfils both stated constraints.
- ✗
AWS Certificate Manager (ACM) for all encryption
Why it's wrong here
ACM provisions and manages TLS certificates, which secure data in transit only; it provides no mechanism for encrypting data at rest. It is tempting because it handles certificate lifecycle automatically, and it is the right choice when the requirement is solely TLS termination for load balancers or CloudFront distributions.
- ✗
SSL certificates for all connections
Why it's wrong here
SSL certificates encrypt traffic in transit but leave stored financial data unencrypted, so they cannot satisfy the at-rest requirement. They are tempting because they are the familiar mechanism for transport security. Certificates would be the correct selection if the scenario required only encrypted client-to-server connections.
- ✓
AWS Key Management Service (KMS) for encryption at rest
Why this is correct
AWS KMS provides managed encryption keys for data at rest across AWS services, satisfying the at-rest encryption requirement for sensitive financial data. It integrates with services such as S3, EBS and DynamoDB, enabling envelope encryption and centralised key control. Paired with TLS, it covers both mandated encryption states.
- ✗
AWS Identity and Access Management (IAM) for data encryption
Why it's wrong here
IAM controls authentication and authorisation — who may call which API — and performs no cryptographic operations on stored or transmitted data. It is tempting because access control is a security control. IAM would be correct when the requirement is least-privilege permissions, not encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.