AWS Certified Solutions Architect Associate SAA-C03 Practice Question
A company has sensitive customer data that must be encrypted at rest in an Amazon S3 bucket. The company must also comply with regulatory requirements that mandate the periodic rotation of encryption keys. Which solution fulfills these requirements and is considered the BEST practice?
Enable Server-Side Encryption with AWS CloudHSM-Managed Keys on the S3 bucket.
Enable Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) on the S3 bucket and leverage automatic key rotation in AWS KMS.
Implement Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) on the S3 bucket.
Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) on the S3 bucket and rotate the keys periodically with a custom solution.