SAP-C02 Design for New Solutions Practice Question
A healthcare company is building a new patient records system on AWS. The system must store documents in Amazon S3 and provide access to authenticated patients and clinicians. The company requires that all data be encrypted at rest with keys that the company can rotate annually and immediately disable if compromised, and that access to the keys be logged for compliance. The company does not want to manage any hardware security modules. Which solution meets these requirements?
⚠ Common exam trap
The trap here is assuming that any S3 encryption option provides customer-controlled key rotation and disablement, when only SSE-KMS with customer managed keys offers that level of control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable AWS CloudTrail logging of KMS API calls.
The requirements demand customer-controlled key lifecycle (annual rotation and immediate disablement) and detailed auditing of key usage, all without managing HSMs. SSE-KMS with customer managed keys provides configurable rotation and the ability to disable a key instantly, while CloudTrail captures all KMS API activity for compliance. The other options either lack key control, lack audit logging, or add unnecessary operational burden.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and enable S3 server access logging.
Why it's wrong here
SSE-S3 uses AES-256 encryption managed entirely by Amazon S3, and the company cannot control key rotation schedules or disable the keys on demand. S3 server access logging records requests to the bucket but does not log key usage. This option fails the requirements for customer-controlled rotation, immediate key disablement, and key usage auditing.
- ✗
Use S3 client-side encryption with a customer-provided key stored in AWS Secrets Manager, and enable AWS CloudTrail data events on the bucket.
Why it's wrong here
Client-side encryption requires the application to perform encryption and key management, adding operational overhead. Secrets Manager can store the key but does not provide automatic annual rotation of the encryption key itself or immediate cryptographic disablement. CloudTrail data events log object-level operations, not key usage, so the compliance logging requirement is not met.
- ✗
Use S3 server-side encryption with AWS KMS AWS managed keys (aws/s3) and enable Amazon S3 Inventory to track encryption status.
Why it's wrong here
AWS managed keys (aws/s3) are rotated automatically every three years and cannot be manually rotated or disabled by the customer. S3 Inventory reports object metadata including encryption status but does not log key usage or provide control over key lifecycle. This option fails the annual rotation, immediate disablement, and key usage logging requirements.
- ✓
Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable AWS CloudTrail logging of KMS API calls.
Why this is correct
SSE-KMS with customer managed keys lets the company define and rotate keys annually via KMS, and disabling the key immediately blocks decryption. CloudTrail logs every KMS API call, including Decrypt and DisableKey, providing the required audit trail. No HSMs need to be managed because KMS is a managed service, satisfying all stated constraints.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.