KMS AWS Key Management Service - SAP-C02 Practice Questions

Review key policies, grants, envelope encryption, multi-Region keys, cross-account access, rotation, and service integrations.

3Questions Available
3Exam Domains

Practice KMS Questions Now

Start a timed practice session focusing on AWS Key Management Service topics from the SAP-C02 question bank.

Start SAP-C02 Practice Quiz →

SAP-C02 KMS Question Bank (3 Questions)

Browse all 3 practice questions covering AWS Key Management Service for the SAP-C02 certification exam. Answers are intentionally hidden on this page so you can self-test first before checking results in quiz mode.

  1. Question 1Design Solutions for Organizational Complexity

    A company wants to give each BU full control over their AWS accounts while enforcing a company-wide encryption policy. SCPs must not grant permissions, only restrict. What is the CORRECT SCP design for enforcing KMS encryption?

    ASCP with Allow effect for all KMS actions
    BSCP with Deny effect on s3:PutObject when s3:x-amz-server-side-encryption is not present
    CSCP with Deny effect blocking iam:CreateUser
    DSCP with Allow effect for only KMS-encrypted services

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  2. Question 2Design Solutions for Organizational Complexity

    A company's security team requires that all data stored in any AWS service must use encryption keys managed by the company (not AWS-managed keys). How should this be enforced organization-wide?

    AEnable default encryption in each service manually
    BApply an SCP denying creation of resources with non-CMK encryption; use AWS Config managed rules to detect and alert on resources not using CMKs
    CUse AWS KMS default key for all services
    DCreate a master key and share it across all accounts

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  3. Question 3Design for New Solutions

    A solutions architect needs to implement end-to-end encryption for a messaging system where messages must be encrypted with keys that AWS cannot decrypt. What pattern achieves this?

    AServer-side encryption with AWS-managed keys
    BClient-side encryption: encrypt messages with a customer-managed key before sending to SQS/SNS; decrypt only at the consumer; use AWS Encryption SDK with a CMK in CloudHSM for key management
    CEnable encryption in transit with TLS
    DUse SSE-S3 for all stored messages

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz

Key KMS Concepts for SAP-C02

kmskeyencryptionkey policygrantmulti-region keycross-accountrotation

SAP-C02 KMS Exam Tips

AWS Key Management Service questions in SAP-C02 are typically scenario-based. Focus on enterprise-scale multi-account architecture, governance, and modernization strategies. Priority concepts: kms, key, encryption, key policy, grant, multi-region key.

What SAP-C02 Expects

  • Anchor your answer in prefer future-proof designs that support organizational complexity and migration realities.
  • KMS scenarios for SAP-C02 are frequently mapped to Domain 1 (26%), Domain 2 (29%), Domain 3 (25%), so read the objective carefully before picking controls or architecture.
  • Expect multi-topic scenarios where KMS interacts with IAM, networking, storage, or observability patterns rather than appearing as an isolated question.
  • When two options are both technically valid, prefer the choice that best aligns with the exam's operational scope (Professional) and vendor best practices.

High-Value KMS Concepts

  • Know the core KMS building blocks cold: kms, key, encryption, key policy.
  • Review the edge-case features and limits for grant, multi-region key; these details are commonly used to differentiate answer choices.
  • Practice service-integration reasoning: how KMS pairs with Security & Compliance, IAM, S3 in real deployment patterns.
  • For SAP-C02, explain why the chosen KMS design meets reliability, security, and cost expectations better than the alternatives.

Common SAP-C02 Traps

  • Watch for answers that work for a single account but fail at organizational scale.
  • Questions in Design Solutions for Organizational Complexity often include distractors that look correct for KMS but violate least-privilege, durability, or availability requirements.
  • Avoid picking options purely by feature name; validate data path, failure handling, and governance impact before answering.
  • If the prompt hints at automation or repeatability, eliminate manual-only operational answers first.

Fast Review Checklist

  • Can you compare at least two KMS implementation paths and justify which one best fits the scenario?
  • Can you map the chosen answer back to Design Solutions for Organizational Complexity (26%) outcomes for SAP-C02?
  • Can you explain security and access boundaries for KMS without relying on default-open assumptions?
  • Can you describe how KMS integrates with Security & Compliance and IAM during failure, scaling, and monitoring events?

Exam Domains Covering KMS

Related Resources

More SAP-C02 Study Resources