CV0-004 Security Practice Question
A financial services firm stores regulated customer records in an Amazon S3 bucket. Auditors require that every object be encrypted at rest with a customer-managed key, that key usage be logged, and that the firm be able to revoke access to the data by disabling the key. Which configuration meets these requirements?
⚠ Common exam trap
The trap here is treating any server-side encryption as equivalent, when only a customer-managed KMS key can be disabled to revoke data access and is fully logged.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure default bucket encryption with SSE-KMS using a customer-managed AWS KMS key and enable CloudTrail data events for the bucket.
The scenario demands a customer-managed key that the firm can disable to revoke access, plus logging of key usage. SSE-KMS with a customer-managed AWS KMS key satisfies the key control because disabling the key blocks decryption, and CloudTrail captures KMS cryptographic operations as well as S3 data events. AWS-managed keys, SSE-S3, and SSE-C all lack the customer-controlled revocation and audit characteristics required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure default bucket encryption with SSE-S3 and enable S3 server access logging on the bucket.
Why it's wrong here
SSE-S3 uses AWS-managed keys that the customer cannot view, manage, or disable, so the firm cannot revoke access by disabling a key. Server access logging records requests to the bucket, not cryptographic key usage, so it does not satisfy the audit requirement for key-usage logging. This combination fails two of the three stated controls.
- ✗
Configure default bucket encryption with SSE-KMS using an AWS-managed key and enable KMS key rotation every year.
Why it's wrong here
An AWS-managed key such as aws/s3 cannot be disabled, edited, or deleted by the customer, so the firm cannot revoke data access by disabling the key. Annual rotation changes backing key material but does not produce per-use audit trails tied to the customer's account, and it does not meet the revocation requirement. The scenario explicitly demands a customer-managed key.
- ✗
Enable S3 Object Lock in compliance mode and require SSE-C headers on every PUT request.
Why it's wrong here
SSE-C requires the client to supply and manage its own encryption keys on every request, and AWS does not store or log those keys, so there is no KMS key to disable for revocation and no key-usage audit trail. Object Lock prevents deletion or overwrite for a retention period; it is a data-retention control, not an encryption or key-management control, so it does not address the requirements.
- ✓
Configure default bucket encryption with SSE-KMS using a customer-managed AWS KMS key and enable CloudTrail data events for the bucket.
Why this is correct
SSE-KMS with a customer-managed key gives the firm control over the key, and disabling that key immediately blocks decryption of all objects, satisfying revocation. AWS KMS logs every cryptographic operation to CloudTrail, and enabling CloudTrail data events captures object-level API activity on the bucket, providing the required usage evidence for auditors.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.