ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Server-side encryption with customer-provided keys (SSE-C) meets both requirements. S3 performs the encryption and decryption on the server side using an AES-256 key that the customer supplies with each request; AWS never stores this key, so the organization retains sole control. Because the cryptographic operations occur within S3, EMR jobs access data at normal S3 performance without the extra latency or code changes associated with client-side encryption.

SSE-S3 and SSE-KMS off-load key management to AWS‐managed or AWS KMS keys, so the organization would not retain exclusive control of the key material. Client-side encryption with an on-premises RSA key keeps keys internal but shifts all cryptographic processing to the application and adds significant overhead, contradicting the desire to minimize performance impact.