SAP-C02 Continuous Improvement for Existing Solutions Practice Question

A company is using Amazon S3 to store critical data. The security team requires that all data at rest be encrypted using AWS KMS with automatic rotation of the customer master key (CMK) every year. What should a solutions architect do to meet this requirement?

⚠ Common exam trap

SAP-C02 often tests the distinction between SSE-S3 (AWS-managed, no customer rotation control), SSE-KMS (customer-managed CMK with automatic rotation), and SSE-C (customer-provided keys, no AWS rotation) — candidates confuse 'automatic rotation' across these models.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 default encryption with AWS KMS and enable automatic rotation of the KMS key.

The requirement is encryption at rest using AWS KMS with automatic annual rotation of the CMK. Enabling S3 default encryption with SSE-KMS satisfies the KMS encryption requirement, and KMS supports automatic key rotation (configurable for customer-managed keys, with a default and minimum of 90 days, commonly set to 365 days). This is the only option that combines KMS-based encryption with managed rotation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use SSE-S3 (Amazon S3-managed keys) and rely on S3's automatic key rotation.
Why it's wrong here
SSE-S3 uses S3-managed AES-256 keys, so no AWS KMS customer master key exists to rotate annually, failing the KMS-with-rotation requirement. It tempts because SSE-S3 is the zero-configuration default for basic at-rest encryption where no customer-controlled key or audit trail is mandated.
✓
Enable S3 default encryption with AWS KMS and enable automatic rotation of the KMS key.
Why this is correct
S3 default encryption with SSE-KMS encrypts every new object at rest under a KMS key, and enabling annual automatic rotation on that customer managed key satisfies both the encryption and rotation requirements without per-object headers.
✗
Use SSE-C (customer-provided keys) and manage key rotation manually.
Why it's wrong here
SSE-C uses customer-supplied keys that S3 stores only for the request; AWS KMS never manages them, so no annual automatic CMK rotation occurs and rotation is manual. It suits organisations mandating keys they fully control, not the stated KMS automatic-rotation requirement.
✗
Use client-side encryption with a KMS CMK and upload the encrypted data.
Why it's wrong here
Client-side encryption encrypts data before upload, so S3 stores ciphertext it cannot decrypt; KMS automatic CMK rotation does not apply to objects you encrypt yourself. It is tempting for end-to-end control, but the requirement is KMS-managed encryption at rest with yearly rotation.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question