PAS-C01 Technology Practice Question
A company is running SAP on AWS and wants to implement encryption at rest for all data. The company uses AWS KMS with Customer Managed Keys (CMKs) for the EBS volumes. The SAP application servers need to access an S3 bucket that contains sensitive data. How should the company ensure that the S3 bucket is encrypted with the same CMK?
⚠ Common exam trap
Watch out — candidates often confuse SSE-S3 (which uses an AWS-managed key) with SSE-KMS (which allows a customer-managed key), and assume that enabling default encryption with SSE-S3 satisfies the requirement to use the same CMK.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the S3 bucket to use SSE-KMS with the same CMK
SSE-KMS (Server-Side Encryption with AWS KMS) allows you to specify a Customer Managed Key (CMK) to encrypt objects in S3. By configuring the S3 bucket to use the same CMK that is already used for EBS volumes, the company ensures a unified encryption key strategy for all data at rest, meeting the requirement for consistent encryption across services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use client-side encryption before uploading to S3
Why it's wrong here
Client-side encryption uses client-managed keys, not the same CMK.
- ✓
Configure the S3 bucket to use SSE-KMS with the same CMK
Why this is correct
SSE-KMS allows specifying a particular CMK.
- ✗
Add a bucket policy that denies if encryption is not present
Why it's wrong here
Policy can enforce encryption but does not specify the key.
- ✗
Enable default encryption on the S3 bucket with SSE-S3
Why it's wrong here
SSE-S3 uses AWS-managed keys, not the same CMK.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.