nerdexam
Amazon

SAP-C02 · Question #876

A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration. The company needs to store large, important documents within the…

The correct answer is B. Use Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to. Amazon S3 provides very high durability and availability for large objects, and you can enforce in- transit encryption via a bucket policy requiring HTTPS and at-rest encryption with SSE-KMS using a customer-managed KMS key. The company manages and rotates that CMK on its own…

Submitted by jian89· Mar 6, 2026Design Secure Architectures

Question

A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration. The company needs to store large, important documents within the application with the following requirements: 1. The data must be highly durable and available. 2. The data must always be encrypted at rest and in transit. 3. The encryption key must be managed by the company and rotated periodically. Which of the following solutions should the solutions architect recommend?

Options

  • ADeploy the storage gateway to AWS in file gateway mode. Use Amazon EBS volume encryption
  • BUse Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to
  • CUse Amazon DynamoDB with SSL to connect to DynamoDB. Use an AWS KMS key to encrypt
  • DDeploy instances with Amazon EBS volumes attached to store this data. Use EBS volume

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    76% (25)
  • C
    9% (3)
  • D
    12% (4)

Explanation

Amazon S3 provides very high durability and availability for large objects, and you can enforce in- transit encryption via a bucket policy requiring HTTPS and at-rest encryption with SSE-KMS using a customer-managed KMS key. The company manages and rotates that CMK on its own schedule, satisfying the key management requirement while using fully managed services.

Topics

#S3 encryption#KMS customer-managed keys#HTTPS enforcement#data security

Community Discussion

No community discussion yet for this question.

Full SAP-C02 Practice