Study SCS-C03 data-at-rest controls for KMS, CloudHSM, integrity, retention, backup, and replication.
At-rest questions on SCS-C03 are not only about whether something is encrypted. AWS also tests integrity, retention, immutability, backup, and replication choices. If the answer only says “use KMS,” it is often missing half the problem.
The current AWS domain guidance includes:
That means a strong answer often combines confidentiality, integrity, and recovery.
| Requirement | Strongest first fit | Why |
|---|---|---|
| Managed encryption for AWS-native storage with strong service integration | AWS KMS-backed server-side or service-native encryption | Strong default for most AWS storage patterns |
| Specialized control over cryptographic material lifecycle or HSM-style boundary needs | CloudHSM or a stricter key-management approach | The requirement is about key-control model, not just encryption on/off |
| Protection against deletion or tampering over a retention window | Object Lock, Vault Lock, versioning, or integrity controls | Integrity and immutability are the core need |
| Secure recovery from data loss or ransomware-style scenarios | AWS Backup, replication, snapshot, or Data Lifecycle Manager patterns | Recovery design matters as much as encryption |
If the prompt mentions accidental overwrite, malicious deletion, legal hold, or tamper evidence, encryption alone is not enough. The exam often wants controls like:
That is an integrity-and-retention problem, not just a confidentiality problem.
Replication improves availability and continuity, but it does not automatically replace backup. A replicated mistake can still be a mistake in two places.
If the requirement mentions:
then backup-oriented controls usually matter explicitly.
When the problem is stored data, break it into four questions:
The strongest SCS-C03 answer usually addresses more than one of those at once.