SCS-C03 Data Protection Practice Question
A security architect is designing a cross-account data sharing solution. Account A owns a KMS Customer Managed Key (CMK) that must be used by an IAM role in Account B to decrypt S3 objects. Which TWO steps are required to enable this cross-account access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the KMS key policy in Account A to grant the IAM role in Account B permission to use the key.
Cross-account access to a KMS key requires permissions to be granted in two places: the key policy (resource-based) and the IAM policy (identity-based). The key owner must trust the external account in the key policy, and the external account's administrator must then grant specific users or roles permission to use that key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the KMS key policy in Account A to grant the IAM role in Account B permission to use the key.
Why this is correct
The key policy is the primary gatekeeper for a KMS key. For cross-account access, the key policy in the owning account must explicitly allow the external account (or a specific principal in that account) to perform cryptographic operations. Without this explicit grant, AWS identity-based policies in Account B will have no effect.
- ✓
Attach an IAM policy to the role in Account B that allows the 'kms:Decrypt' action on the Key ARN in Account A.
Why this is correct
Even if the key policy in Account A allows access, the IAM role in Account B must also have an identity-based policy that explicitly permits the required KMS actions. In cross-account scenarios, permissions must be granted by both the resource owner and the identity owner to satisfy the evaluation logic.
- ✗
Create a VPC Peering connection between Account A and Account B to allow KMS traffic.
Why it's wrong here
KMS is a regional service with public endpoints, and its access is governed by IAM and key policies, not by network-level peering. While VPC endpoints can be used for private access, they are not a requirement for cross-account KMS permissions, which are strictly handled through the AWS control plane and authorization policies.
- ✗
Configure the IAM role in Account B to assume a role in Account A that has KMS permissions.
Why it's wrong here
While role assumption is a valid cross-account strategy, it is not required for KMS. KMS keys support resource-based policies that can grant direct access to external principals. Directly granting the permission is often preferred for performance and simplicity, as it avoids the overhead of managing an additional intermediate role.
- ✗
Enable 'KMS Multi-Region' support on the key in Account A to allow it to be seen by Account B.
Why it's wrong here
Multi-region keys are used to replicate key material across different AWS regions, not to share keys between different accounts. A single-region key can be shared across accounts just as easily as a multi-region key. Cross-account access is a matter of policy configuration, not the physical or regional scope of the key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.