SAP-C02 Design for New Solutions Practice Question
A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?
⚠ Common exam trap
Watch out — candidates often assume that specifying a cross-account KMS key ARN in the S3 bucket configuration is sufficient, overlooking the mandatory two-way policy update (KMS key policy in the key-owning account and S3 bucket policy in the bucket-owning account) required for cross-account KMS operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.
When using an AWS KMS CMK from a different account (Account B) for SSE-KMS on an S3 bucket in Account A, you must explicitly grant Account A access to the key via the KMS key policy in Account B. Additionally, the S3 bucket policy in Account A must allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 will use these permissions to encrypt and decrypt objects on behalf of the bucket owner. Without both policy updates, the cross-account KMS operation will fail with an access denied error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.
Why it's wrong here
Without proper permissions, S3 cannot access the key.
- ✗
Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.
Why it's wrong here
The S3 bucket policy must also allow the use of a specific KMS key.
- ✓
Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.
Why this is correct
Both policies are required for cross-account SSE-KMS.
- ✗
Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.
Why it's wrong here
A KMS key policy in Account B must also grant Account A access to the key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.