PAS-C01 Technology Practice Question
A company is using SAP HANA on AWS and needs to back up the database to Amazon S3. The backup must be encrypted at rest in S3. The company already uses AWS KMS for encryption. What is the MOST secure way to configure the backup?
⚠ Common exam trap
Many candidates assume the AWS managed key for S3 (aws/s3) is sufficient for encryption, but the question explicitly asks for the 'most secure' way, which requires customer managed keys with restrictive key policies to meet compliance and audit requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SSE-KMS with a customer managed key and restrict key usage with key policies.
Using SSE-KMS with a customer managed key allows you to enforce granular key policies, including restricting key usage to specific IAM roles or conditions, and enables audit trails via AWS CloudTrail. This provides the highest level of control and security for encrypting SAP HANA backups at rest in S3, meeting the requirement for the most secure configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use SSE-KMS with a customer managed key and restrict key usage with key policies.
Why this is correct
Provides control and integration with existing KMS.
- ✗
Use client-side encryption before uploading to S3.
Why it's wrong here
Adds complexity and key management overhead.
- ✗
Enable default S3 encryption with SSE-S3.
Why it's wrong here
Uses AWS-managed keys, not company's KMS keys.
- ✗
Use SSE-KMS with the AWS managed key for S3.
Why it's wrong here
AWS managed key, not customer managed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to automate the backup of its SAP HANA database to Amazon S3. The database is running on an EC2 instance with a 500 GB gp3 volume. The backup should be encrypted at rest in S3. What is the most efficient way to achieve this with minimal operational overhead?
easy- ✓ A.Use the SAP HANA Backup and Restore integration with Amazon S3 to back up directly to S3 buckets, enabling default S3 encryption.
- B.Back up to an EBS snapshot, then copy the snapshot to S3 using AWS Backup.
- C.Schedule an AWS Backup plan to back up the EC2 instance and its EBS volumes.
- D.Use AWS Storage Gateway to back up the database to S3, then enable S3 encryption.
Why A: SAP HANA natively supports direct backup to Amazon S3 via the SAP HANA Backup and Restore integration, which uses the S3 API to stream backup files directly to an S3 bucket. This eliminates the need for intermediate storage or additional services, and enabling default S3 encryption (SSE-S3 or SSE-KMS) ensures data is encrypted at rest with minimal configuration overhead, meeting the requirement for efficiency and low operational burden.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.