Encrypt SAP HANA Data at Rest with Customer-Managed Keys
An organization runs SAP on AWS and wants to encrypt all data at rest for the SAP HANA database. The encryption keys must be managed by the customer and rotated annually. Which THREE AWS services can be used together to meet these requirements? (Choose THREE.)
Quick Answer
The correct answer is a combination of AWS KMS, AWS CloudHSM, and Amazon EBS encryption. This trio meets the requirement because AWS KMS provides the customer master keys (CMKs) that control access, while AWS CloudHSM offers a dedicated hardware security module (HSM) for generating and storing the key material, ensuring the customer retains sole management. Amazon EBS encryption then uses these KMS keys to transparently encrypt the underlying block storage volumes where SAP HANA data resides, covering all data at rest. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this scenario tests your understanding of the layered encryption model for SAP HANA, often appearing as a multi-select question where a common trap is confusing S3 server-side encryption or ACM certificates for this specific use case. Remember the memory tip: “KMS for control, CloudHSM for custody, EBS for coverage” — each service plays a distinct role in encrypting SAP HANA data at rest with customer-managed keys.
⚠ Common exam trap
A common mistake is to confuse ACM (which handles certificates for encryption in transit) with services that handle encryption at rest (KMS, CloudHSM, EBS encryption). ACM does not provide encryption at rest and is not relevant for encrypting SAP HANA database storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EBS encryption
Amazon EBS encryption is correct because SAP HANA databases on AWS typically store data on EBS volumes, and enabling EBS encryption ensures data at rest is encrypted using AWS KMS keys. This directly meets the requirement for encrypting the SAP HANA database storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 server-side encryption
Why it's wrong here
S3 SSE is for object storage, not directly for EBS volumes.
- ✓
Amazon EBS encryption
Why this is correct
EBS volumes can be encrypted using KMS keys.
- ✓
AWS Key Management Service (KMS)
Why this is correct
KMS allows you to create and manage customer managed keys with automatic annual rotation.
- ✓
AWS CloudHSM
Why this is correct
CloudHSM provides dedicated HSM for key storage and can be used with KMS via custom key store.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM manages SSL/TLS certificates, not encryption keys for data at rest.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO options are valid methods for encrypting data at rest in an SAP HANA database running on Amazon EBS? (Choose two.)
medium- A.Use SSL/TLS connections to the database.
- ✓ B.Enable SAP HANA native encryption for the database.
- C.Use AWS KMS to encrypt the database schema.
- D.Store database files in Amazon S3 with SSE-S3.
- ✓ E.Enable EBS encryption when launching the EC2 instance.
Why B: SAP HANA provides native encryption capabilities that encrypt data at rest within the database itself, including data files, log files, and backups. This encryption is managed by SAP HANA's own key management system and operates independently of the underlying storage layer, making it a valid method for encrypting data at rest on Amazon EBS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.