S3 Encryption at Rest Options: SSE-S3 and SSE-KMS
A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)
Quick Answer
The answer is SSE-S3 and SSE-KMS, as both are server-side encryption options that encrypt data at rest within Amazon S3. SSE-S3 uses S3-managed keys with AES-256 encryption, while SSE-KMS provides additional control through AWS Key Management Service, including separate permissions, audit trails, and automatic key rotation. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this question tests your ability to distinguish between encryption at rest and in transit, with common traps including client-side encryption (which occurs before data reaches S3) and SSL/TLS (which protects data in motion). A frequent distractor is confusing S3 Access Points or bucket policies with encryption mechanisms. Remember the mnemonic "S3-KMS for control, S3-S3 for simple" to recall that SSE-KMS offers key management and audit capabilities, while SSE-S3 is the straightforward, default option for encrypting objects at rest.
⚠ Common exam trap
Candidates often confuse encryption in transit (SSL/TLS) with encryption at rest, or think that access controls (S3 Access Points) provide encryption, leading them to select options A or B instead of focusing on the two server-side encryption methods (SSE-S3 and SSE-KMS) that directly encrypt data at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use server-side encryption with Amazon S3 managed keys (SSE-S3)
Server-side encryption with Amazon S3 managed keys (SSE-S3) encrypts data at rest using AES-256, with S3 managing the encryption keys entirely. This meets the requirement for encryption at rest without any additional customer effort or key management overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable SSL/TLS for all data transfers
Why it's wrong here
SSL/TLS protects data in transit, not at rest.
- ✗
Use S3 Access Points with a bucket policy
Why it's wrong here
Access Points do not provide encryption.
- ✓
Use server-side encryption with Amazon S3 managed keys (SSE-S3)
Why this is correct
SSE-S3 encrypts data at rest.
- ✗
Use client-side encryption before uploading
Why it's wrong here
Client-side encryption is not at rest encryption.
- ✓
Use server-side encryption with AWS KMS (SSE-KMS)
Why this is correct
SSE-KMS encrypts data at rest.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?
hard- A.Server-side encryption with customer-provided keys (SSE-C)
- B.Server-side encryption with AWS KMS managed keys (SSE-KMS)
- ✓ C.Server-side encryption with S3 managed keys (SSE-S3)
- D.Client-side encryption
Why C: SSE-S3 uses AWS-managed keys that are automatically rotated. Option A is wrong because SSE-C uses customer-provided keys. Option B is wrong because SSE-KMS uses customer-managed KMS keys. Option D is wrong because client-side encryption is managed by the customer.
Variation 2. A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?
medium- A.Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.
- B.Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.
- ✓ C.Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.
- D.Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.
Why C: SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.