CV0-004 Security Practice Question
A company stores sensitive customer data in an Amazon S3 bucket. A security audit reveals that the data is encrypted at rest using SSE-S3. The company now requires that they manage and control the encryption keys themselves, including the ability to rotate and revoke them. Which S3 encryption option should be used?
⚠ Common exam trap
The trap here is assuming that any KMS-based encryption gives full customer control, when AWS managed keys do not permit rotation or revocation by the customer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSE-KMS with customer managed keys
SSE-KMS with customer managed keys gives the organization ownership and control of the KMS keys used to encrypt S3 objects. This allows key rotation, policy management, and revocation, which aligns with the audit requirement. Other S3 encryption options either lack customer key control or place management outside the S3 server-side encryption model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client-side encryption
Why it's wrong here
Client-side encryption means the customer encrypts data before uploading it to S3 and manages the keys entirely outside AWS. While this gives full control, it shifts significant operational overhead to the customer and is not an S3 server-side encryption option. The scenario asks for an S3 encryption option where the company manages keys, which is best met by SSE-KMS with customer managed keys.
- ✗
SSE-S3
Why it's wrong here
SSE-S3 uses encryption keys that are fully managed by AWS. Customers cannot view, manage, rotate, or revoke these keys. Since the requirement is for the company to manage and control the encryption keys, SSE-S3 does not meet the need. It is the simplest option but provides the least customer control over key lifecycle.
- ✗
SSE-KMS with AWS managed keys
Why it's wrong here
SSE-KMS with AWS managed keys uses keys that are created and managed by AWS on the customer's behalf. While it provides audit trails through CloudTrail, the customer cannot rotate or revoke these keys directly. The requirement explicitly states the company must manage and control the keys, so AWS managed keys are insufficient here.
- ✓
SSE-KMS with customer managed keys
Why this is correct
SSE-KMS with customer managed keys allows the organization to create and control the KMS keys used for S3 encryption. The customer can define key policies, enable automatic rotation, and disable or revoke keys when needed. This satisfies the requirement for full control over key management, including rotation and revocation, while still using S3 server-side encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.