SAP-C02 Design for New Solutions Practice Question
A company is designing a new application that will store sensitive customer data in Amazon S3. The data must be encrypted at rest. The company wants to use an encryption solution that provides an audit trail of when keys are used and by whom. The company also wants to rotate the encryption keys automatically every year. Which two options meet these requirements? (Choose TWO.)
⚠ Common exam trap
Many candidates assume SSE-S3 (Option A) provides an audit trail because it encrypts data at rest, but they overlook that SSE-S3 does not log key usage in CloudTrail, making it unsuitable for the audit requirement, while SSE-KMS (Option E) is the only server-side option that meets both audit and rotation needs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use client-side encryption with an AWS KMS managed key
Client-side encryption with an AWS KMS managed key allows the application to encrypt data before uploading to S3, providing full control over key usage and an audit trail via AWS CloudTrail for every KMS API call (e.g., Encrypt, Decrypt). Option E is correct because SSE-KMS uses AWS KMS to manage the encryption keys, automatically rotates them annually (when using a KMS key with automatic rotation enabled), and logs all key usage in CloudTrail, meeting the audit trail requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with S3 managed keys (SSE-S3)
Why it's wrong here
SSE-S3 does not provide audit trail of key usage.
- ✓
Use client-side encryption with an AWS KMS managed key
Why this is correct
Client-side encryption with KMS also provides audit trail and key rotation.
- ✗
Use server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C does not provide automatic key rotation.
- ✗
Use client-side encryption with a master key stored in AWS Secrets Manager
Why it's wrong here
Does not provide automatic rotation or audit trail of key usage.
- ✓
Use server-side encryption with AWS KMS managed keys (SSE-KMS)
Why this is correct
SSE-KMS integrates with CloudTrail for audit and supports automatic key rotation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.