GCIH Securing Credentials and Data in Cloud Practice Question
A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys managed by AWS Key Management Service (KMS) and that the encryption is enforced automatically for all new objects. Which configuration should they implement?
⚠ Common exam trap
A common mix-up: candidates confuse encryption in transit with encryption at rest, or assuming that SSE-S3 satisfies a requirement for KMS-managed keys when it uses S3-managed keys instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key.
Enabling default encryption with SSE-KMS and a customer managed key ensures that all new objects are encrypted using KMS-managed keys, meeting both the encryption at rest and key management requirements. It also provides auditability and control over the keys. Other options either use non-KMS keys, only enforce encryption without specifying key type, or address transit encryption instead of at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Certificate Manager (ACM) to provision SSL/TLS certificates for the S3 bucket.
Why it's wrong here
ACM provides SSL/TLS certificates for encrypting data in transit, not at rest. It does not address encryption of objects stored in S3. While encryption in transit is important, the scenario specifically asks for encryption at rest with KMS-managed keys. Using ACM would not fulfill the requirement and would leave data unencrypted at rest unless another mechanism is applied.
- ✗
Create a bucket policy that denies unencrypted PutObject requests.
Why it's wrong here
A bucket policy that denies unencrypted uploads enforces encryption but does not specify the use of KMS-managed keys. Users could still upload objects encrypted with SSE-S3 or client-side encryption, which may not meet the KMS requirement. Additionally, this policy alone does not configure default encryption; it only blocks requests that lack encryption headers, potentially causing operational issues if not paired with default encryption.
- ✗
Enable default encryption on the S3 bucket using SSE-S3 (AES-256).
Why it's wrong here
SSE-S3 uses S3-managed keys, not KMS-managed keys. While it provides encryption at rest, it does not meet the requirement for KMS-managed keys. Additionally, SSE-S3 does not offer the granular access control and audit capabilities of KMS, such as separate key policies and CloudTrail logging of key usage. The scenario specifically requires KMS-managed keys, so this option is insufficient.
- ✓
Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key.
Why this is correct
SSE-KMS with a customer managed key uses AWS KMS to manage the encryption keys, providing centralized control, audit trails via CloudTrail, and the ability to rotate keys. Enabling default encryption ensures all new objects are encrypted automatically without relying on users to specify encryption headers. This directly satisfies the requirement for KMS-managed keys and enforced encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This GCIH question is part of Courseiva's 322-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.