SAP-C02 Design for New Solutions Practice Question
A company is designing a new serverless application that processes sensitive financial data. The application uses AWS Lambda functions that read from and write to an Amazon S3 bucket. The company requires that the data be encrypted at rest and in transit, and that access to the S3 bucket be restricted to only the Lambda functions. The company also wants to minimize management overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)
⚠ Common exam trap
The trap here is thinking that presigned URLs or stored credentials are needed for Lambda to access S3, but Lambda should use IAM roles, and presigned URLs are for external users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) and grant the Lambda execution role permissions to use the KMS key.
To encrypt data at rest with granular control, use SSE-KMS and grant the Lambda execution role access to the KMS key. To restrict access to only Lambda functions and enforce encryption in transit, attach an S3 bucket policy that allows the Lambda execution role and denies non-HTTPS requests. These actions meet the requirements with minimal overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the S3 bucket to use server-side encryption with AWS KMS (SSE-KMS) and grant the Lambda execution role permissions to use the KMS key.
Why this is correct
SSE-KMS provides encryption at rest with centralized key management. Granting the Lambda execution role permissions to the KMS key allows the functions to encrypt and decrypt data. This approach meets the encryption requirement and minimizes overhead by using managed keys.
- ✗
Use Amazon S3 presigned URLs to allow Lambda functions to access the bucket without credentials.
Why it's wrong here
Presigned URLs are for temporary access by external users, not for Lambda functions. They do not restrict access to only Lambda functions and do not provide encryption at rest. Using them would not meet the security requirements and adds unnecessary complexity.
- ✓
Attach an S3 bucket policy that allows access only from the Lambda function's execution role and enforces encryption in transit using aws:SecureTransport.
Why this is correct
An S3 bucket policy can restrict access to specific IAM roles, such as the Lambda execution role. Adding a condition for aws:SecureTransport enforces HTTPS, ensuring encryption in transit. This meets the access and encryption requirements with minimal management overhead.
- ✗
Enable S3 default encryption with Amazon S3 managed keys (SSE-S3) and use VPC endpoints to access the bucket.
Why it's wrong here
SSE-S3 provides encryption at rest but does not allow granular access control to the key. VPC endpoints enable private connectivity but do not restrict access to only Lambda functions. This combination does not fully meet the requirement to restrict access to only the Lambda functions.
- ✗
Store the S3 bucket credentials in AWS Secrets Manager and have the Lambda functions retrieve them at runtime.
Why it's wrong here
Storing credentials in Secrets Manager is unnecessary because Lambda functions should use IAM roles for access. This approach increases management overhead and does not provide encryption at rest or restrict access to only Lambda functions. It is not a best practice for AWS Lambda.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.