SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is implementing a data lake on AWS using Amazon S3 as the storage layer. The data lake must support multiple consumer accounts within the organization. The security team requires that data is encrypted at rest using AWS KMS with customer-managed keys (CMKs) and that access to the keys is strictly controlled. Which THREE steps should be taken to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse SCPs with resource-based policies, thinking an SCP can enforce cross-account encryption access, when in reality SCPs only set permission boundaries and cannot grant the specific KMS key usage permissions required for cross-account decryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a customer-managed KMS key with a key policy that allows the consumer accounts to use the key.
Creating a customer-managed KMS key (CMK) with a key policy that explicitly grants the consumer accounts permission to use the key (e.g., via the `kms:Decrypt` and `kms:GenerateDataKey` actions) is required for cross-account encryption. This ensures that the S3 bucket can encrypt objects with the CMK, and consumer accounts can decrypt them using their own IAM permissions, meeting the security team's requirement for strict key control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a customer-managed KMS key with a key policy that allows the consumer accounts to use the key.
Why this is correct
Allows cross-account decryption.
- ✓
Grant cross-account access to the S3 bucket using bucket policies.
Why this is correct
Allows consumer accounts to access the data.
- ✓
Configure the S3 bucket policy to deny uploads that do not use the required KMS key.
Why this is correct
Enforces encryption at upload time.
- ✗
Use an SCP to require that all S3 buckets use server-side encryption with KMS.
Why it's wrong here
SCPs cannot enforce encryption settings on existing buckets.
- ✗
Create IAM roles in each consumer account that grant access to the KMS key.
Why it's wrong here
Not necessary; key policy can grant access directly.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.