SCS-C02 Data Protection Practice Question
A company is using Amazon S3 to store backup files that must be retained for 7 years. The files are accessed infrequently but must be available within minutes when needed. The company wants to minimize storage costs while ensuring data is encrypted at rest. Which storage class and encryption combination is most cost-effective?
⚠ Common exam trap
The trap is choosing Glacier Deep Archive for cost savings while ignoring the retrieval time requirement, or assuming SSE-KMS is required for encryption when SSE-S3 is sufficient and free.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 Glacier Instant Retrieval with SSE-S3
S3 Glacier Instant Retrieval provides millisecond retrieval (meeting the 'within minutes' requirement) at lower cost than S3 Standard-IA, and SSE-S3 provides encryption at rest at no additional cost. This combination minimizes storage costs while meeting access and encryption requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S3 Glacier Instant Retrieval with SSE-S3
Why this is correct
S3 Glacier Instant Retrieval provides millisecond access to backup files while offering a lower storage price than S3 Standard-IA, making it both fast and cost-effective for backups that must be available immediately. Using SSE-S3 for encryption adds no per-object or per-API charges, so you satisfy the server-side encryption requirement without increasing the cost of the solution. This combination directly meets the stated need for instant retrieval and economical long-term storage.
- ✗
S3 Glacier Deep Archive with SSE-S3
Why it's wrong here
S3 Glacier Deep Archive has the lowest storage cost of all S3 classes, but its retrieval times range from 12 to 48 hours, which fails the requirement for access in minutes. While SSE-S3 encrypts data at no additional cost, the extreme retrieval latency makes this class suitable only for cold archival data that can tolerate overnight or multi-day retrieval. Choosing Deep Archive would violate the access-time requirement despite the low storage price and free encryption.
- ✗
S3 Glacier Flexible Retrieval with SSE-KMS
Why it's wrong here
S3 Glacier Flexible Retrieval offers retrieval times from minutes to hours depending on the retrieval tier, so it cannot guarantee the immediate, millisecond access provided by Glacier Instant Retrieval. Additionally, using SSE-KMS instead of SSE-S3 introduces KMS API call charges and potential key management overhead, raising the total cost of the backup solution. The combination of slower retrieval and extra KMS costs makes this option less suitable than Instant Retrieval with SSE-S3.
- ✗
S3 Standard-IA with SSE-KMS
Why it's wrong here
S3 Standard-IA does provide instant retrieval and is intended for infrequently accessed data, but its per-gigabyte storage price is higher than that of Glacier Instant Retrieval, so it would be needlessly expensive for long-term backups. Adding SSE-KMS rather than the free SSE-S3 option also incurs KMS API charges, making the solution even costlier without any additional security benefit. This option meets the access requirement but is not the most cost-effective choice when Glacier Instant Retrieval is available.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.