A solutions architect is designing an encryption strategy for S3. The company wants to manage the keys in AWS but requires that the keys cannot be exported from the AWS KMS service. Which key type should be used?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: AWS KMS Customer Managed Keys (CMKs)

KMS keys are stored in FIPS 140-2 Level 3 validated hardware security modules and never leave the KMS service in unencrypted form....

📋Part of AWS Certified Solutions Architect – Associate (SAA-C03) · AWS Certification Practice

Real Exam ScenarioAWS KMS

A solutions architect is designing an encryption strategy for S3. The company wants to manage the keys in AWS but requires that the keys cannot be exported from the AWS KMS service. Which key type should be used?

✓ Correct Answer & ExplanationAWS KMS

Correct Answer

AWS KMS Customer Managed Keys (CMKs)

Why This Answer Is Correct

KMS keys are stored in FIPS 140-2 Level 3 validated hardware security modules and never leave the KMS service in unencrypted form.

📚 What This Question Tests

This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Associate (SAA-C03). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All AWS Certified Solutions Architect – Associate (SAA-C03) Questions →Browse All AWS Exams →

A solutions architect is designing an encryption strategy for S3. The company wants to manage the keys in AWS but requires that the keys cannot be exported from the AWS KMS service. Which key type should be used?

A solutions architect is designing an encryption strategy for S3. The company wants to manage the keys in AWS but requires that the keys cannot be exported from the AWS KMS service. Which key type should be used?

📚 What This Question Tests

More AWS KMS Practice Questions