SCS-C02 Data Protection Practice Question
A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?
⚠ Common exam trap
Many candidates confuse 'AWS managed key' with 'customer-managed KMS key with automatic rotation enabled,' but the key distinction is that a customer-managed key is not an AWS managed key—it is managed by the customer, even if rotation is automated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable EBS encryption by default using the AWS managed key for Amazon EBS.
Enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SSE-S3.
Why it's wrong here
SSE-S3 is an S3-specific encryption mode that uses S3-managed keys to encrypt objects at rest in Amazon Simple Storage Service. EBS volumes are block-level storage devices attached to EC2 instances, not S3 objects, so SSE-S3 has no ability to encrypt the volume's raw blocks. Applying SSE-S3 would not meet the EBS encryption requirement.
- ✓
Enable EBS encryption by default using the AWS managed key for Amazon EBS.
Why this is correct
Enable EBS encryption by default establishes that every newly created EBS volume and snapshot is encrypted with the volume's key—the AWS managed key with alias aws/ebs—without requiring per-volume configuration. Because this is an AWS managed key, AWS rotates it automatically and handles the key material, so the company does not need to manage lifecycle or permissions. This satisfies the requirement to encrypt data at rest in the EBS volume directly at the block-storage layer.
- ✗
Use a customer-managed KMS key with automatic rotation enabled.
Why it's wrong here
A customer-managed KMS key is created and owned by the company, giving full control over rotation schedule, key policy, and deletion. You can enable automatic rotation for such a key, but in this scenario the requirement specifically asks for an AWS managed key for EBS, not a customer-owned key. Choosing a customer-managed key would introduce additional key management duties and would not match the stated need, making it incorrect here.
- ✗
Use client-side encryption.
Why it's wrong here
Client-side encryption requires the application to encrypt data before writing it to the EBS volume, meaning the volume itself remains unencrypted at rest. This approach depends on the application implementing and managing encryption logic, and it does not provide the transparent, OS-level encryption offered by native EBS encryption. Because the requirement is for the EBS volume to be encrypted at rest, client-side encryption is not a direct solution.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.