SAA-C03 Q602 · Security

Question

A company needs a cloud-based solution for backup, recovery, and archiving while retaining encryption key material control. Which combination of solutions will meet these requirements? (Select TWO)

Accepted Answer

The critical requirement is **retaining control of encryption key material**. Let's break down each correct answer:

**Answer A — KMS with Imported Key Material (BYOK):**
1. You create a KMS key with **no key material** (an empty key shell).
2. You then **import your own key material** into this KMS key.
3. This means the company **generated and controls the key material** — they can delete it from KMS at any time, and they retain a copy outside AWS.
4. This is AWS's **Bring Your Own Key (BYOK)** model, which directly satisfies 'retaining encryption key material control.'

**Answer D — S3 Glacier with SSE-C:**
1. **S3 Glacier** is the ideal storage class for **archiving** (long-term, infrequent access, low cost).
2. **SSE-C (Server-Side Encryption with Customer-Provided Keys)** means the c

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips