S3 encryption options in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding S3 Server-Side Encryption Types

Which S3 server-side encryption option uses AWS Key Management Service (KMS) to manage encryption keys?

A SSE-KMS (encryption with keys managed in AWS KMS)

B SSE-S3 (AES-256 encryption managed by Amazon S3)

C SSE-C (customer-provided encryption keys)

D Client-side encryption before uploading

💡 Hint

Think about which option integrates with AWS KMS for key management.

SSE-KMS uses AWS Key Management Service to manage encryption keys, providing additional control and audit capabilities compared to SSE-S3.

❓ service_behavior

intermediate

S3 Bucket Default Encryption Behavior

If you enable default encryption on an S3 bucket with SSE-S3, what happens when a new object is uploaded without specifying encryption?

A The object is stored unencrypted.

B The upload fails with an error.

C The object is encrypted using SSE-KMS automatically.

D The object is encrypted using SSE-S3 automatically.

💡 Hint

Consider the effect of default encryption settings on new uploads.

When default encryption is enabled with SSE-S3, all new objects are encrypted automatically using SSE-S3 if no encryption is specified.

❓ Configuration

advanced

Configuring S3 Bucket Policy for Enforcing Encryption

Which bucket policy condition enforces that all PUT requests must use SSE-KMS encryption?

A "Condition": {"Bool": {"aws:SecureTransport": "false"}}

B "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "AES256"}}

C "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

D "Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

💡 Hint

Look for the condition that matches SSE-KMS encryption header.

The condition with "s3:x-amz-server-side-encryption": "aws:kms" ensures that PUT requests use SSE-KMS encryption.

❓ security

advanced

Security Implications of SSE-C Encryption

What is a key security responsibility when using SSE-C (server-side encryption with customer-provided keys) in S3?

A No encryption keys are needed because encryption is client-side.

B You must securely manage and provide the encryption key with each request.

C Encryption keys are stored in AWS KMS for auditing.

D AWS manages and rotates the encryption keys automatically.

💡 Hint

Think about who controls the keys in SSE-C.

With SSE-C, the customer provides the encryption key with each request and is responsible for managing it securely. AWS does not store the key.

❓ Architecture

expert

Choosing Encryption for Compliance and Audit Needs

Your company requires detailed audit logs for encryption key usage and wants to control key rotation policies. Which S3 encryption option best meets these requirements?

A SSE-KMS with customer-managed keys in AWS KMS

B SSE-S3 with default Amazon-managed keys

C SSE-C with customer-provided keys

D Client-side encryption before uploading

💡 Hint

Consider which option offers audit logs and key rotation control.

SSE-KMS with customer-managed keys allows detailed audit logging and key rotation control via AWS KMS, meeting compliance needs.