SCS-C02 Infrastructure Security Practice Question
A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?
⚠ Common exam trap
Many exam-takers confuse AWS CloudHSM with KMS because both involve encryption keys, but CloudHSM is a hardware-based key storage service that lacks native integration with S3 for centralized key management, whereas KMS is the intended service for SSE-KMS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM is a single-tenant hardware security module service that provides dedicated, FIPS-validated cryptographic devices for you to manage and operate. However, Amazon S3 does not natively integrate with CloudHSM for server-side encryption; you would need to build a custom key management solution, and CloudHSM lacks the centralized key lifecycle features and IAM integration that KMS offers. For simply encrypting data at rest in S3, CloudHSM is an over-engineered, non-managed alternative, not the correct service.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager (ACM) is a service for provisioning, managing, and renewing TLS/SSL certificates, which are used to encrypt traffic in transit between clients and AWS endpoints such as Elastic Load Balancers or CloudFront. It does not create, store, or manage symmetric data encryption keys needed to encrypt object contents at rest, and it has no integration with S3's server-side encryption features. Because it only handles certificates and not data keys, ACM cannot be used to encrypt an S3 bucket at rest.
- ✓
AWS Key Management Service (AWS KMS)
Why this is correct
AWS Key Management Service (AWS KMS) is a fully managed service that centralizes the creation, storage, rotation, and deletion of customer master keys (CMKs). S3 integrates with KMS through server-side encryption (SSE-KMS), where S3 uses a KMS key to encrypt each object's data key automatically and enforces IAM policies on key usage. This gives you centralized control, auditability through CloudTrail, and seamless S3 encryption, making KMS the correct and standard service for encrypting data at rest in S3.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is designed to securely store and rotate secrets like database credentials, API keys, and OAuth tokens, not for managing encryption keys used for S3 at-rest encryption. While you could theoretically store a key as a secret, Secrets Manager is not an encryption key management service and does not participate in S3's envelope encryption or SSE integrations. It lacks the cryptographic APIs and IAM key-based controls of KMS, so it cannot fulfill the requirement to encrypt data in an S3 bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.