Free SAA-C03 practice scenarios: KMS encryption

Encryption at rest done the exam's way — customer-managed keys, key policies, rotation and envelope encryption. Six scenarios, SAA-C03, 2026 edition.

Try 6 free KMS scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 6 free questions ↓

KMS is how the SAA-C03 tests encryption at rest, and it rewards a handful of concepts rather than any cryptography. The scenarios turn on control and auditability: who holds the key, who may use it, and whether every use is logged.

SSE-KMS vs SSE-S3

Both encrypt objects at rest; the difference is control. SSE-S3 uses keys AWS manages entirely — simple, but you get no key policy, no rotation control, and no per-use audit. SSE-KMS with a customer-managed key gives you the key policy, rotation you choose, and a CloudTrail record of every encrypt and decrypt. When a requirement says “control the key” or “audit every use”, it is SSE-KMS.

The key hierarchy: who controls the key

Customer-managed key — you define the policy, rotation, and lifecycle. The answer whenever compliance requires you to control the key.
AWS-managed key — AWS controls it on your behalf; convenient, but no policy or lifecycle control for you.
AWS-owned key — shared and invisible.

Access to any key is governed by its key policy — a resource-based policy that is the primary control over who may use it, and the mechanism for granting a role in another account access. Not a security group, not a bucket policy.

Rotation and envelope encryption

Two behaviours the exam loves. Automatic key rotation replaces the key material yearly while keeping the old material, so nothing is re-encrypted and old data stays readable — the answer to “rotate yearly without re-encrypting”. And envelope encryption is why KMS scales: KMS hands back a data key, the service encrypts the object locally and stores the encrypted data key with the ciphertext, so large objects never travel to KMS.

The gotcha: existing unencrypted volumes

You cannot encrypt an existing unencrypted EBS volume in place. The path is snapshot → copy the snapshot with encryption → create a new volume from the encrypted copy, then swap it in. Account-level default encryption only applies to new resources. This “re-create it encrypted” pattern is a recurring exam answer.

How to use the six scenarios below

Answer each one before opening the explanation, and when you miss, name the requirement that decided it — “control the key”, “audit every use”, “rotate without re-encrypting”, “another account”, “existing volume”. Every explanation states that constraint and dismantles the distractors, which are usually a weaker encryption option or the wrong access control. For the domain overview, see Design Secure Architectures.

How AWS KMS protects data with envelope encryption. A customer-managed KMS key never leaves KMS; it generates a data key, returning both a plaintext copy and an encrypted copy. The service encrypts the data locally with the plaintext data key, then stores the encrypted data key beside the ciphertext. A key policy controls which principals, including other accounts, may use the key, automatic rotation replaces the key material yearly without re-encrypting data, and every key use is logged to CloudTrail.

6 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 6

A company must encrypt objects at rest in Amazon S3, control the encryption key itself, and have an audit trail of every time the key is used. Which option meets all three requirements?

Answer: A — Server-side encryption with a customer-managed KMS key (SSE-KMS).

SSE-KMS with a customer-managed key gives you control over the key and its policy, and logs every encrypt and decrypt call to CloudTrail — matching 'control the key' and 'audit trail of every use'. Why not the others: SSE-S3 encrypts the data but AWS manages the key, so you get neither key control nor a per-use audit trail. A hard-coded client-side key is an operational and security liability with no managed rotation or logging. A private bucket is access control, not encryption at rest. Key control plus an audit trail is SSE-KMS.

SAA-C03 Question 2 of 6

A security policy requires that a KMS encryption key's cryptographic material be rotated every year, but re-encrypting the large volume of existing data is not acceptable. How can this be achieved?

Answer: A — Enable automatic key rotation on the customer-managed KMS key.

Automatic key rotation generates new backing key material on a yearly schedule while retaining the old material, so previously encrypted data stays readable and nothing is re-encrypted — exactly the requirement. Why not the others: manually rotating and re-encrypting is the effort the requirement rules out. Deleting a key destroys the ability to decrypt data protected by it and is irreversible after a waiting period. Disabling and re-enabling does not rotate the material at all. Yearly rotation without re-encryption is automatic key rotation.

SAA-C03 Question 3 of 6

An engineer needs to encrypt an existing, unencrypted Amazon EBS volume attached to a running instance. What is the correct approach?

Answer: A — Snapshot the volume, copy the snapshot with encryption enabled, and create a new encrypted volume from it.

You cannot encrypt an existing unencrypted EBS volume in place. The supported path is to take a snapshot, copy that snapshot with encryption enabled, and create a new encrypted volume from the encrypted copy — then swap it in. Why not the others: there is no in-place toggle to encrypt a live volume, and you cannot 'attach a key' to an unencrypted volume. Account-level default encryption applies to newly created volumes and snapshots, not retroactively to existing ones. Encrypting existing EBS data means the snapshot-copy-recreate path.

SAA-C03 Question 4 of 6

A company needs to control precisely which IAM principals — including a role in another AWS account — may use a particular KMS key. Which mechanism is the primary control for this?

Answer: A — The KMS key policy (a resource-based policy on the key).

Every KMS key has a key policy — a resource-based policy that is the primary control over who can use and manage the key, and it can grant access to principals in other accounts. Why not the others: security groups control network traffic to elastic network interfaces, not access to a KMS key. An S3 bucket policy governs a bucket, not a key. Rotation controls the key material's lifecycle, not who may use it. Who may use a KMS key is the key policy.

SAA-C03 Question 5 of 6

How does AWS KMS allow a service to encrypt very large objects efficiently without sending the data itself to KMS?

Answer: A — Envelope encryption — KMS returns a data key that encrypts the data locally, and the encrypted data key is stored with the ciphertext.

In envelope encryption, KMS generates a data key and returns a plaintext copy and an encrypted copy; the service encrypts the object locally with the plaintext data key, discards the plaintext, and stores the encrypted data key next to the ciphertext. The large object never travels to KMS. Why not the others: KMS does not encrypt bulk data by ingesting the whole object, does not retain your plaintext, and this is encryption at rest, not merely in transit. Efficient large-object encryption is envelope encryption.

SAA-C03 Question 6 of 6

A compliance requirement states that the organisation — not AWS — must define the key policy, control rotation, and be able to disable the key. Which type of KMS key should be used?

Answer: A — A customer-managed key.

A customer-managed key gives you full control: you define the key policy, choose rotation, and can disable or schedule deletion — exactly what the compliance requirement demands. Why not the others: AWS-managed keys are created and controlled by AWS on your behalf, so you cannot set their policy or manage their lifecycle. AWS-owned keys are shared across accounts and entirely invisible to you. Obfuscation is not encryption and provides no real protection. Full customer control of the key is a customer-managed key.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

SSE-KMS or SSE-S3 — which does the exam prefer?

It depends on the requirement. SSE-S3 is simple, AWS-managed encryption at rest. SSE-KMS is the answer when the scenario needs control over the key, a key policy, rotation you manage, or an audit trail of key usage in CloudTrail. Watch for the words 'control the key' or 'audit every use'.

Do I need to know cryptography for the SAA-C03?

No. You need the concepts: customer-managed versus AWS-managed keys, key policies as the primary access control, automatic rotation, envelope encryption, and the fact that existing unencrypted resources must be re-created encrypted. The exam tests selection and behaviour, not algorithms.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

What is the one-line takeaway?

Use SSE-KMS with a customer-managed key for control and auditability, control access with the key policy, turn on automatic rotation, and re-create existing unencrypted volumes from an encrypted snapshot copy.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.