ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Enabling server-side encryption with Amazon S3-managed keys (SSE-S3) causes S3 to encrypt every object automatically with the AES-256 cipher, providing data-at-rest protection without requiring the customer to create or rotate any keys. Adding a bucket policy that enforces HTTPS ensures all PUT and GET operations are protected by TLS, giving confidentiality in transit. Relying only on IAM permissions would not protect the data if the storage media were compromised or if plaintext HTTP were allowed. Client-side encryption with an AWS KMS customer-managed key also protects data, but it obliges developers to add encryption and decryption logic to the application and to manage the storage of encrypted data keys, making operations more complex than SSE-S3. Cross-region replication primarily improves durability and availability and does not itself prevent disclosure. Therefore, SSE-S3 combined with enforced HTTPS is the most secure and lowest-maintenance solution.