SAA-C03 Q335 · Security

Question

A company is preparing to store confidential data in Amazon S3. For compliance reasons, the data must be encrypted at rest. Encryption key usage must be logged for auditing purposes. Keys must be rotated every year. Which solution meets these requirements and is the MOST operationally efficient?

Accepted Answer

**D. SSE-KMS with automatic rotation** satisfies all three requirements with the least operational overhead:

1. **Encryption at rest**: SSE-KMS encrypts data at rest in S3 using AWS KMS keys — ✅
2. **Key usage logging for auditing**: Every use of a KMS key is automatically logged in **AWS CloudTrail**. Each Encrypt/Decrypt/GenerateDataKey API call creates a CloudTrail event, providing a complete audit trail — ✅
3. **Annual key rotation**: AWS KMS supports **automatic key rotation** for customer managed KMS keys. When enabled, KMS automatically rotates the key material **once every year (365 days)** — ✅
4. **Most operationally efficient**: Automatic rotation requires zero manual intervention. AWS manages the rotation process, retains old key material for decrypting previously encrypted dat

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips