Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Associate · AWS
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
SSE-S3 has the least operational overhead for encryption at rest with automatic key rotation because AWS fully manages the keys and their rotation (even if the schedule isn't user-configurable to be strictly annual). However, if the strict annual rotation is a non-negotiable requirement, then you would have to accept the slightly higher (but still relatively low) operational overhead of managing a KMS customer managed key with automatic annual rotation enabled. Option D. Given the wording of the original question prioritizing "least operational overhead," the intended answer likely leans towards the fully managed nature of SSE-S3's automatic rotation, even without a guaranteed annual cycle. If strict annual rotation was paramount, the question should have been phrased differently. IMHO
For me it is B and C. C because it does everything automatically and this is the requirement. (with LEAST operational overhead)
I think Amazon S3 managed keys (SSE-S3) are designed for and exclusively support encryption of objects within Amazon S3 storage only.....