ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Encrypting the files on the client with the auditor's RSA public key means the private key needed for decryption is never shared or stored in AWS. Only the auditor, who controls the matching private key, can decrypt the data, satisfying the requirement that your organization cannot access the plaintext or the decryption key.

Using S3 server-side encryption with a customer-managed CMK would still allow your organization (and AWS) to decrypt the data, violating the requirement. Enabling default SSE-S3 similarly lets AWS manage and use the keys. Creating an asymmetric CMK in AWS KMS and trying to export its private key is impossible because AWS never allows the private portion of a KMS asymmetric key to leave the service. Therefore, client-side encryption with the auditor's public key is the only compliant option that keeps the existing AWS CLI workflow largely unchanged.