How to Encrypt SQS Queue Data at Rest?
A company uses Amazon Simple Queue Service (Amazon SQS) to decouple its microservices architecture. Some messages in an SQS queue contain sensitive information. A developer must implement a solution that encrypts all the data at rest. Which solution will meet this requirement?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can distinguish between encryption at rest (server-side encryption) and encryption in transit (TLS/HTTPS), with the subtle trap being options that sound secure but only protect data during transmission.
For DVA-C02, enabling SQS server-side encryption (SSE-SQS or SSE-KMS) is the correct way to encrypt messages at rest in Amazon SQS. The community unanimously confirms option A as the valid solution for sensitive data encryption.
Choosing option B (using aws:SecureTransport) is the most common mistake because it enforces HTTPS but only encrypts data in transit, not at rest in the SQS queue.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon SQS supports server-side encryption (SSE) to protect message content at rest. Enabling SSE-SQS uses an AWS-managed SQS encryption key, while SSE-KMS gives you control via AWS KMS keys. The official documentation linked in comment [1] clearly explains that SSE encrypts the body of messages in queues, meeting the requirement for data at rest encryption. Community comments [2] and [3] reinforce that option A is the valid way to enable encryption for sensitive data.
Why the Other Options Are Wrong
Option B (aws:SecureTransport) enforces HTTPS (TLS) for requests, which is encryption in transit, not at rest—so it does not satisfy the requirement. Option C (ACM certificate) is used for TLS/SSL encryption in transit for services like load balancers or API endpoints, not for SQS message encryption. Option D (setting a message attribute ENCRYPT=true) is not a real SQS feature; SQS does not encrypt messages based on attributes. Comments [2] explicitly note that C and D relate to in-transit or are invalid.
Community Comment Notes
Comment [1] provides the official AWS SQS developer guide link for server-side encryption, which is a strong reference. Comment [3] explains that SSE protects the contents of messages using SQS-managed keys or KMS keys, clarifying the available options. Comment [4] simply agrees with A. The community unanimously chose A (100% votes), and no one supported B, C, or D, indicating the answer is straightforward when you recall the SSE feature.
Official Reference
Exam Strategy
When you see 'encrypt data at rest' in any AWS service question, immediately think of server-side encryption (SSE) options like SSE-S3, SSE-SQS, or SSE-KMS. Carefully read whether the question says 'at rest' or 'in transit' to avoid traps that offer TLS or certificate-based solutions.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →