SAP-C02 Design for New Solutions Practice Question

A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?

⚠ Common exam trap

A common mix-up: candidates think SSE-S3 (Option B) is sufficient because it encrypts data at rest, but they overlook the requirement for a specific 90-day rotation schedule and detailed key usage audit trail, which SSE-S3 cannot provide.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.

Meets all requirements with the least operational overhead. Client-side encryption with the AWS Encryption SDK ensures data is encrypted at rest. Keys are stored in AWS Secrets Manager, which supports automatic rotation on a custom 90-day schedule. CloudTrail logs all Secrets Manager API calls, providing an audit trail of key usage. Option A requires custom Lambda code for rotation. Option B uses SSE-S3, which cannot be rotated on a 90-day schedule and lacks key usage audit. Option C uses SSE-KMS, but automatic rotation for customer managed keys is fixed at 365 days, failing the 90-day requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use S3 server-side encryption with customer-provided keys (SSE-C) and implement a Lambda function to rotate keys every 90 days.
Why it's wrong here
SSE-C requires you to manage keys and implement a Lambda function for rotation, creating operational overhead. Additionally, SSE-C does not provide an audit trail of key usage without additional logging.
✗
Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 server access logs.
Why it's wrong here
SSE-S3 encrypts data at rest but uses AWS-managed keys that cannot be rotated on a custom 90-day schedule. S3 server access logs track requests, not key usage.
✗
Use S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and enable automatic key rotation every 90 days. Enable AWS CloudTrail for KMS key usage logging.
Why it's wrong here
SSE-KMS provides encryption at rest and key usage logging via CloudTrail, but automatic key rotation for customer managed keys is fixed at 365 days. To achieve 90-day rotation would require manual or custom automation, increasing overhead.
✓
Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.
Why this is correct
Client-side encryption with the AWS Encryption SDK encrypts data before upload, ensuring at-rest encryption. Secrets Manager can store the keys and automatically rotate them every 90 days with no custom code. CloudTrail logs all Secrets Manager access, providing an audit trail of key usage. This meets all requirements with least operational overhead.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Design for New Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question