SAA-C03 Q249 · Security

Question

A solutions architect is storing sensitive data generated by an application in Amazon S3. The solutions architect wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS KMS key was used and by whom. Which encryption option will meet these requirements?

Accepted Answer

**SSE-KMS (Server-side encryption with AWS KMS managed keys)** meets both requirements:

1. **Encryption at rest**: SSE-KMS encrypts data stored in S3 using keys managed by AWS KMS. When an object is uploaded, S3 requests a data encryption key from KMS, encrypts the object, and stores the encrypted object alongside the encrypted data key.

2. **Audit trail of key usage**: This is the critical differentiator. Every time an SSE-KMS key is used (for encrypt or decrypt operations), **AWS CloudTrail automatically logs the API call** to KMS. The CloudTrail log entry includes:
   - **Who** made the request (IAM principal/ARN)
   - **When** the request was made (timestamp)
   - **Which key** was used (Key ID/ARN)
   - **What operation** was performed (GenerateDataKey, Decrypt, etc.)
   - Source IP

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips