Client-Side Encryption for External Key Management

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

D Encrypt data at the source before uploading to ensure keys remain outside AWS Cloud.

Question

A financial company needs to handle highly sensitive data. The company will store the data in an Amazon S3 bucket. The company needs to ensure that the data is encrypted in transit and at rest. The company must manage the encryption keys outside the AWS Cloud. Which solution will meet these requirements?
  1. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) customer managed key.
  2. Encrypt the data in the S3 bucket with server-side encryption (SSE) that uses an AWS Key Management Service (AWS KMS) AWS managed key.
  3. Encrypt the data in the S3 bucket with the default server-side encryption (SSE).
  4. Encrypt the data at the company's data center before storing the data in the S3 bucket. Correct Answer

Key Takeaways

The core trap is confusing Server-Side Encryption (SSE) with Client-Side Encryption; SSE always relies on AWS infrastructure for at least part of the process, whereas client-side encryption allows full external key control.

This question explores the requirements for encrypting sensitive data in Amazon S3 while maintaining external control over encryption keys. The correct solution involves client-side encryption to satisfy both transit/rest encryption and off-cloud key management.

Common mistake: Many candidates select Option A because AWS KMS Customer-Managed Keys offer high security, but they fail to notice that KMS keys are still managed within the AWS Cloud, violating the 'outside the AWS Cloud' constraint.

Expert Analysis

Why the Answer Is Correct

Option D is the only choice that fully satisfies the requirement to manage encryption keys outside of the AWS Cloud. By performing encryption at the data center (client-side), the company retains absolute control over the keys using their own hardware or software. This method ensures data is encrypted before it leaves the premises, covering both transit and rest states once uploaded to S3.

Why the Other Options Are Wrong

Options A, B, and C all utilize Server-Side Encryption (SSE). Even with a Customer-Managed Key (CMK) in Option A, the key material is stored and managed by AWS KMS, which is an AWS service inside the cloud. Therefore, these options do not meet the strict requirement of managing keys externally. Option C uses AWS-owned keys, offering the least control.

Community Comment Notes

Community consensus strongly supports D, with users noting that options A, B, and C inherently require key storage within AWS. As one user noted, "A Key is safe but came from the customer" implies external origin, but only client-side encryption guarantees the key never touches AWS management systems. Another comment highlights that SSE secures data at rest but client-side encryption covers the entire lifecycle including transfer initiation.

Official Reference

https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always read the 'key management' constraint carefully. If the question demands keys be managed outside AWS, AWS KMS options are incorrect regardless of how secure they seem. Look for 'Client-Side Encryption' or 'Encrypt before upload'.

Frequently Asked Questions

Why is AWS KMS Customer Managed Key not correct?

AWS KMS manages the keys within the AWS Cloud environment. The requirement explicitly states keys must be managed outside the AWS Cloud.

Does client-side encryption cover data in transit?

Yes. Since data is encrypted before leaving the data center, it remains encrypted during transit via HTTPS and at rest in S3.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. chasingsummer 👍 4 Answered D
    Given the requirement to manage encryption keys outside the AWS Cloud, option D is the most suitable solution, despite not directly utilizing AWS's native encryption services like SSE with AWS KMS. Instead, it leverages external encryption mechanisms controlled by the company.
  2. Johnoppong101 👍 4
    You get to do it, keep moving...
  3. osmk 👍 3 Answered D
    Client-side encryption – You encrypt your data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, encryption keys, and related tools.https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html
  4. Mikado211 👍 3 Answered D
    A, B and C need to have the key stored in AWS cloud. D is correct.
  5. giovanna_mag 👍 2 Answered D
    For me it's D, it's the only one that provides encryption also in transit
Show 3 more comments
  1. rondelldell 👍 2
    A Key is safe but came from the customer
  2. Scheldon 👍 1 Answered D
    AnswerD Hence we need to encrypt data not only during the rest but during the transfer as well, we need execute client-side encyprion. SSE will only secure data during rest hence we can eliminate A,B and C. https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html
  3. asdfcdsxdfc 👍 3
    A looks correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide