Amazon AWS Certified Solutions Architect Associate SAA-C03 Encryption Key Management and TLS Practice Test

 

Topic 05 covers encryption key management and TLS for the AWS Certified Solutions Architect – Associate certification. These original SAA-C03 questions distinguish key ownership, key authorization, transport encryption, lifecycle management, and encrypted-access troubleshooting. Select one answer unless a fixed number is requested. Each alternative includes the decisive technical reason. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page.

Question 1

An application stores routine business data in S3 and needs server-side encryption with the least key-management overhead. The company does not need to control key policy, rotation settings, or cross-account key grants. Which choice best fits?

1. Use a service-managed encryption option that meets the S3 requirement.
2. Deploy an AWS CloudHSM cluster and create application keys directly in the HSM.
3. Create a separate customer managed KMS key for every object.
4. Encrypt every object in the application and disable all S3 server-side encryption.

Correct Answer: A

 

Correct Answer

Answer A is correct because When customer control over the KMS key is not required, a service-managed encryption option minimizes key administration while still encrypting data at rest.

Incorrect Answers

Answer B is incorrect because CloudHSM provides dedicated HSM control but adds substantial management overhead that the requirement explicitly avoids.

Answer C is incorrect because Per-object customer keys create unnecessary policy, quota, and lifecycle overhead for a workload that does not require customer key control.

Answer D is incorrect because Application encryption can provide extra control, but it is unnecessary when the requirement prioritizes minimal key-management overhead.

 

Question 2

A regulated workload requires the security team to control which principals can decrypt data, view key-use logs, disable the key, and define rotation settings. Which key ownership model is most appropriate?

1. Use an ACM public certificate as the data-encryption key.
2. Use a customer managed KMS key.
3. Use an unencrypted data key stored in an S3 object.
4. Use an AWS owned key only.

Correct Answer: B

 

Correct Answer

Answer B is correct because A customer managed KMS key gives the customer control of the key policy, lifecycle, and supported rotation settings while integrating with AWS services.

Incorrect Answers

Answer A is incorrect because ACM certificates are for TLS and certificate use cases, not as general-purpose KMS keys for service data at rest.

Answer C is incorrect because An unencrypted key stored beside data would weaken protection and does not provide managed authorization or lifecycle controls.

Answer D is incorrect because AWS owned keys are managed by the service and do not expose the customer key-policy and lifecycle controls required here.

 

Question 3

A financial application must keep cryptographic keys in dedicated HSMs that the company controls directly and must use PKCS #11 from its own software. Which AWS service best matches?

1. AWS Certificate Manager
2. AWS CloudHSM
3. AWS Secrets Manager
4. Amazon Cognito

Correct Answer: B

 

Correct Answer

Answer B is correct because CloudHSM provides customer-controlled HSMs and cryptographic interfaces such as PKCS #11 for direct key operations.

Incorrect Answers

Answer A is incorrect because ACM manages certificates for TLS use and does not provide direct general-purpose PKCS #11 HSM key ownership.

Answer C is incorrect because Secrets Manager stores and rotates secret values; it is not a dedicated HSM cryptographic service.

Answer D is incorrect because Cognito manages application identities and temporary credentials, not direct HSM key operations. It therefore does not satisfy the scenario’s decisive requirement: Customer-controlled keys.

 

Question 4

A team wants client-side encryption so plaintext is never sent to S3. The application can manage envelope encryption and must control when plaintext data keys exist in memory. Which approach best meets that boundary?

1. Use an S3 lifecycle rule to transition the object immediately to Glacier.
2. Enable S3 Versioning and rely on older versions for confidentiality.
3. Use only SSE-S3 and upload plaintext over HTTPS.
4. Encrypt in the application before uploading ciphertext to S3.

Correct Answer: D

 

Correct Answer

Answer D is correct because Client-side encryption keeps plaintext out of S3 because the application encrypts before transmission and controls data-key use locally.

Incorrect Answers

Answer A is incorrect because Storage class transition changes retention economics, not where encryption occurs. It therefore does not satisfy the scenario’s decisive requirement: Envelope encryption acceptable.

Answer B is incorrect because Versioning supports recovery from changes but does not encrypt plaintext before it reaches S3.

Answer C is incorrect because SSE-S3 encrypts after S3 receives the object, so it does not meet the requirement that plaintext never be sent to S3.

 

Question 5

A company needs AWS service integration with KMS, customer control of key policy, and automatic rotation of AWS-generated symmetric key material. Which choice satisfies all three requirements?

1. An asymmetric customer managed KMS key with automatic rotation.
2. An AWS managed KMS key whose policy the customer rewrites.
3. Use a symmetric customer managed KMS key with automatic rotation.
4. A CloudHSM key that KMS automatically rotates every year.

Correct Answer: C

 

Correct Answer

Answer C is correct because Customer managed KMS keys provide customer policy control, integrate with AWS services, and support automatic rotation when the key is symmetric with AWS-generated material.

Incorrect Answers

Answer A is incorrect because Automatic KMS rotation is not supported for asymmetric KMS keys. It therefore does not satisfy the scenario’s decisive requirement: Automatic symmetric key rotation.

Answer B is incorrect because AWS managed keys are service-managed; customers cannot replace their key policy with a customer-defined policy.

Answer D is incorrect because CloudHSM keys are managed directly in the HSM and do not use KMS automatic key rotation in the stated way.

 

Question 6

An IAM role has kms:Decrypt in its identity policy, but decrypt requests against a customer managed key are denied. The key policy neither grants the role access nor enables account IAM policies to grant access. What must be corrected?

1. Rotate the key material.
2. Authorize the role through the KMS key policy path.
3. Create a new ACM certificate.
4. Add s3:GetObject to the role.

Correct Answer: B

 

Correct Answer

Answer B is correct because KMS key policies are the primary authorization mechanism. An IAM allow alone is ineffective when the key policy does not enable or grant the required access.

Incorrect Answers

Answer A is incorrect because Rotation changes backing key material while preserving the key identity and policies; it does not grant missing authorization.

Answer C is incorrect because TLS certificates are unrelated to KMS authorization for decrypting data. It therefore does not satisfy the scenario’s decisive requirement: Decrypt denied.

Answer D is incorrect because S3 object permission does not authorize the KMS decrypt operation that is currently denied.

 

Question 7

Account A owns a customer managed KMS key. A role in Account B must decrypt data with that key. Which TWO permissions are required for cross-account use? Choose TWO.

1. CloudTrail must be disabled in both accounts.
2. The KMS key must be copied into Account B.
3. The role in Account B must be made the root user of Account A.
4. Allow the KMS operation in the role policy in Account B.
5. Allow the external principal in Account A’s KMS key policy.

Correct Answers: D, E

 

Correct Answers

Answer D is correct because The external principal also needs identity-side permission in its own account. This applies directly to the scenario’s decisive requirement: Cross-account decrypt.

Answer E is correct because Cross-account KMS use requires authorization from the key-owning account through the key policy.

Incorrect Answers

Answer A is incorrect because Logging has no role in granting KMS permissions and disabling it would reduce audit evidence.

Answer B is incorrect because KMS supports cross-account cryptographic use without copying the key when both authorization sides are configured.

Answer C is incorrect because Cross-account KMS use does not require or justify root credentials. It therefore does not satisfy the scenario’s decisive requirement: Cross-account decrypt.

 

Question 8

An AWS service needs temporary permission to use a KMS key on behalf of a resource, and the team wants a permission object that can later be retired or revoked without editing the full key policy. Which mechanism best matches?

1. Create a constrained KMS grant.
2. Enable automatic key rotation.
3. Change the key alias to the service name.
4. Create a second root user for the service.

Correct Answer: A

 

Correct Answer

Answer A is correct because KMS grants delegate a limited subset of key operations and can be retired or revoked independently of the key policy.

Incorrect Answers

Answer B is incorrect because Rotation changes key material over time and does not create temporary delegated authorization. It therefore does not satisfy the scenario’s decisive requirement: Revocable permission.

Answer C is incorrect because Aliases identify keys but do not grant permission to use them. It therefore does not satisfy the scenario’s decisive requirement: Revocable permission.

Answer D is incorrect because AWS accounts have one root user and services should not receive root credentials for KMS use.

 

Question 9

A security organization wants key administrators to create and disable KMS keys but not decrypt application data. Application roles may encrypt and decrypt but must not change key policy or schedule deletion. Which design best supports this separation?

1. Give only the application roles kms:ScheduleKeyDeletion so administrators cannot remove data.
2. Give both groups kms:* because KMS logs all actions.
3. Use separate policy statements and roles for key administration and cryptographic use.
4. Use one shared IAM user for administrators and applications.

Correct Answer: C

 

Correct Answer

Answer C is correct because KMS permissions can be separated so administrators manage key lifecycle while application principals receive only cryptographic operations.

Incorrect Answers

Answer A is incorrect because Deletion authority is a lifecycle administration privilege and would increase application-role risk rather than separate duties.

Answer B is incorrect because Audit logging does not substitute for least privilege and would let applications change or delete the key.

Answer D is incorrect because A shared identity removes accountability and cannot enforce the required separation of duties. It therefore does not satisfy the scenario’s decisive requirement: No cross-role privilege overlap.

 

Question 10

A service role can encrypt with a KMS key but cannot decrypt ciphertext produced by the same key. The key policy allows only kms:Encrypt for that role. Which change is directly required if the role must also read the protected data?

1. Enable key rotation so old ciphertext becomes readable.
2. Add kms:Decrypt for the role through the KMS authorization path.
3. Change the key alias to include the word decrypt.
4. Move the ciphertext to another S3 prefix.

Correct Answer: B

 

Correct Answer

Answer B is correct because Encrypt and decrypt are separate KMS operations. A role allowed only Encrypt cannot decrypt until Decrypt is explicitly authorized.

Incorrect Answers

Answer A is incorrect because Rotation retains old key material for valid authorized decrypt operations but does not add missing permission.

Answer C is incorrect because Aliases do not alter the permissions available to a principal. It therefore does not satisfy the scenario’s decisive requirement: Same KMS key.

Answer D is incorrect because Object location does not change whether the role is authorized to call KMS Decrypt.

 

Question 11

A public web application uses an Application Load Balancer. The team wants the ALB to terminate HTTPS for clients and manage the public certificate through AWS. Which design is appropriate?

1. Create a Cognito identity pool and treat temporary credentials as TLS certificates.
2. Configure an HTTP-only listener and attach a KMS key instead of a certificate.
3. Use an ALB HTTPS listener with an ACM certificate.
4. Use S3 Object Lock to protect the ALB DNS name.

Correct Answer: C

 

Correct Answer

Answer C is correct because An ALB HTTPS listener terminates client TLS and can use a certificate managed by ACM.

Incorrect Answers

Answer A is incorrect because AWS credentials authorize API actions; they are not X.509 server certificates for HTTPS.

Answer B is incorrect because A KMS key cannot substitute for the server certificate required to negotiate HTTPS. It therefore does not satisfy the scenario’s decisive requirement: Managed certificate.

Answer D is incorrect because Object Lock protects S3 object versions and has no role in TLS negotiation. It therefore does not satisfy the scenario’s decisive requirement: Managed certificate.

 

Question 12

An ALB terminates client HTTPS, but a policy requires encryption from the load balancer to the EC2 targets as well. What should the architect do?

1. Use HTTPS from the ALB to the targets.
2. Attach a KMS key to the target group and keep HTTP.
3. Use an HTTP target group because traffic inside a VPC is always cryptographically encrypted by the ALB.
4. Move the EC2 instances to public subnets so they can negotiate TLS.

Correct Answer: A

 

Correct Answer

Answer A is correct because Terminating TLS at the ALB does not prevent a second TLS connection to targets; HTTPS target connections preserve encryption on the backend hop.

Incorrect Answers

Answer B is incorrect because KMS key attachment does not transform HTTP target traffic into TLS. It therefore does not satisfy the scenario’s decisive requirement: EC2 targets.

Answer C is incorrect because An HTTP target connection is plaintext at the application protocol layer and does not satisfy an explicit end-to-end encryption requirement.

Answer D is incorrect because Subnet exposure is unrelated to the ability to run HTTPS between the ALB and targets.

 

Question 13

A company requests an ACM certificate in eu-west-1 and then tries to attach it to a CloudFront distribution. The certificate does not appear as an option. What is the most likely correction?

1. Move the CloudFront distribution to eu-west-1.
2. Disable HTTPS on the distribution and rely on S3 encryption at rest.
3. Request or import the CloudFront viewer certificate in us-east-1.
4. Convert the certificate into a KMS asymmetric key.

Correct Answer: C

 

Correct Answer

Answer C is correct because CloudFront uses ACM certificates from US East (N. Virginia), regardless of the origin Region.

Incorrect Answers

Answer A is incorrect because CloudFront is a global service and its ACM certificate requirement is not satisfied by moving the distribution to the origin Region.

Answer B is incorrect because At-rest encryption does not provide TLS to viewers and would abandon the stated secure transport requirement.

Answer D is incorrect because KMS asymmetric keys do not replace the X.509 certificate CloudFront needs for TLS.

 

Question 14

An HTTPS client receives a certificate-name error when connecting to api.example.com. The ALB listener certificate is valid and unexpired but contains only www.example.com. What should be corrected?

1. Add api.example.com to the security group description.
2. Increase the ALB idle timeout.
3. Enable KMS key rotation for the certificate.
4. Use a certificate that covers api.example.com.

Correct Answer: D

 

Correct Answer

Answer D is correct because TLS hostname validation requires the requested hostname to be represented by the server certificate.

Incorrect Answers

Answer A is incorrect because Security group metadata does not affect certificate hostname validation. It therefore does not satisfy the scenario’s decisive requirement: ALB HTTPS listener.

Answer B is incorrect because Connection timeout settings cannot fix a hostname mismatch during TLS validation. It therefore does not satisfy the scenario’s decisive requirement: ALB HTTPS listener.

Answer C is incorrect because KMS rotation does not change the names in an X.509 server certificate. It therefore does not satisfy the scenario’s decisive requirement: ALB HTTPS listener.

 

Question 15

An internal service must authenticate client certificates in addition to encrypting transport when connections arrive at an Application Load Balancer. Which ALB capability directly addresses the client-certificate requirement?

1. Use ALB mutual TLS in verify mode.
2. Use a Cognito identity pool as the TLS trust store.
3. Use a WAF rate-based rule to count client certificates.
4. Enable S3 Versioning on the ALB access-log bucket.

Correct Answer: A

 

Correct Answer

Answer A is correct because ALB mutual TLS verify mode can validate client X.509 certificates against the configured trust store.

Incorrect Answers

Answer B is incorrect because Cognito identity pools issue temporary AWS credentials and are not certificate-authority trust stores.

Answer C is incorrect because WAF request-rate controls do not perform X.509 client certificate validation. It therefore does not satisfy the scenario’s decisive requirement: Validate client X.509 certificate.

Answer D is incorrect because Versioning protects log history but does not authenticate TLS clients. It therefore does not satisfy the scenario’s decisive requirement: Validate client X.509 certificate.

 

Question 16

A customer managed symmetric KMS key uses AWS-generated key material. The security policy requires periodic key-material rotation without changing the key ARN used by applications. Which feature should be enabled?

1. Renew an ACM certificate on the same schedule.
2. Enable automatic rotation on the customer managed KMS key.
3. Create a new key manually every day and delete the previous key immediately.
4. Change the KMS alias each month.

Correct Answer: B

 

Correct Answer

Answer B is correct because KMS can rotate supported symmetric customer-managed key material while retaining the logical key identity and old material for decryption.

Incorrect Answers

Answer A is incorrect because Certificate renewal concerns TLS credentials, not KMS data-encryption key material. It therefore does not satisfy the scenario’s decisive requirement: Keep same key ARN.

Answer C is incorrect because Deleting old keys would make ciphertext unrecoverable and force applications to change key identifiers.

Answer D is incorrect because Aliases are names that point to keys; changing an alias does not rotate cryptographic key material.

 

Question 17

A team rotates a symmetric KMS key and then discovers old S3 objects are still decryptable with the same key ARN. Is this expected?

1. Only if the application copied the old plaintext key into Secrets Manager.
2. No. Rotation should make all previously encrypted objects unreadable.
3. Yes; KMS retains older backing key material for authorized decryption.
4. Only if the S3 bucket is public.

Correct Answer: C

 

Correct Answer

Answer C is correct because Rotation adds new backing material for future encryption while retaining older material needed to decrypt existing ciphertext.

Incorrect Answers

Answer A is incorrect because Applications do not need to store old KMS backing keys; KMS manages the versions transparently.

Answer B is incorrect because Destroying old material on rotation would break existing ciphertext and is not how KMS automatic rotation works.

Answer D is incorrect because S3 public access has no bearing on whether KMS retains prior key material for authorized decryption.

 

Question 18

An administrator is uncertain whether a customer managed KMS key is still required. The key protects archival data that might need to be restored. Which action is safer while the dependency is investigated?

1. Schedule the shortest possible deletion immediately.
2. Rotate the key repeatedly until usage becomes obvious.
3. Disable the key while the dependency is investigated.
4. Delete the encrypted archives so the key is no longer needed.

Correct Answer: C

 

Correct Answer

Answer C is correct because A disabled key can be re-enabled after dependencies are understood, whereas completed deletion destroys key material and can make protected data unrecoverable.

Incorrect Answers

Answer A is incorrect because The waiting period gives time to cancel, but the safer reversible state during investigation is disablement rather than advancing toward destructive deletion.

Answer B is incorrect because Rotation does not reveal all ciphertext dependencies and does not replace dependency analysis. It therefore does not satisfy the scenario’s decisive requirement: Avoid irreversible loss.

Answer D is incorrect because Destroying data does not satisfy the stated requirement to preserve possible future restoration. It therefore does not satisfy the scenario’s decisive requirement: Avoid irreversible loss.

 

Question 19

A customer managed KMS key is scheduled for deletion with a 14-day waiting period. What is the key’s practical state during the pending-deletion period?

1. It automatically rotates once before deletion.
2. It continues encrypting and decrypting until the final second of the waiting period.
3. It becomes an AWS managed key so AWS can preserve old ciphertext.
4. It is unusable for cryptographic operations while pending deletion.

Correct Answer: D

 

Correct Answer

Answer D is correct because A key pending deletion becomes unusable for cryptographic operations during the waiting period, though the scheduled deletion can still be canceled before completion.

Incorrect Answers

Answer A is incorrect because Key rotation is not performed while the key is pending deletion. It therefore does not satisfy the scenario’s decisive requirement: Need current key behavior.

Answer B is incorrect because KMS does not leave a pending-deletion key usable for normal cryptographic operations throughout the waiting period.

Answer C is incorrect because Scheduling deletion does not transfer ownership or convert the key type. It therefore does not satisfy the scenario’s decisive requirement: Need current key behavior.

 

Question 20

An ACM-issued public certificate is attached to an integrated AWS service and remains eligible for managed renewal. The team wants to reduce manual certificate replacement work. Which approach is appropriate?

1. Export the private key and replace the ACM certificate with a self-signed certificate each month.
2. Schedule deletion of the KMS key that protects unrelated application data.
3. Store the certificate expiration date in S3 Object Lock and rely on retention for renewal.
4. Keep the eligible ACM-managed certificate attached and maintain renewal validation.

Correct Answer: D

 

Correct Answer

Answer D is correct because ACM can manage renewal for eligible certificates used with integrated services, avoiding manual replacement when validation remains possible.

Incorrect Answers

Answer A is incorrect because Replacing the managed certificate with a self-signed certificate creates recurring manual lifecycle work and loses the managed-certificate renewal benefit.

Answer B is incorrect because KMS key deletion has no role in renewing an ACM TLS certificate. It therefore does not satisfy the scenario’s decisive requirement: Reduce manual renewal.

Answer C is incorrect because Retention can preserve the record but cannot issue or renew a certificate. It therefore does not satisfy the scenario’s decisive requirement: Reduce manual renewal.

 

Question 21

An IAM role can read an encrypted S3 object according to the bucket policy, but GetObject fails with an access-denied error from KMS. The object uses a customer managed KMS key. Which permission should be investigated next?

1. Whether the role can renew an ACM certificate.
2. Check whether the role can use the KMS key for decryption.
3. Whether the role can create a new S3 bucket.
4. Whether CloudFront caching is enabled.

Correct Answer: B

 

Correct Answer

Answer B is correct because S3 object permission and KMS key permission are separate; encrypted object reads can fail when the role lacks KMS decrypt authorization.

Incorrect Answers

Answer A is incorrect because TLS certificate lifecycle does not control at-rest decryption of the S3 object. It therefore does not satisfy the scenario’s decisive requirement: KMS access denied.

Answer C is incorrect because Bucket creation authority is unrelated to reading this already-existing encrypted object. It therefore does not satisfy the scenario’s decisive requirement: KMS access denied.

Answer D is incorrect because Caching does not grant KMS decrypt permission to the requesting role. It therefore does not satisfy the scenario’s decisive requirement: KMS access denied.

 

Question 22

An AWS service is configured to encrypt with a customer managed KMS key, but service operations fail after a new restrictive key policy is deployed. The workload role itself still has KMS permissions. What should the architect check?

1. Whether the KMS alias contains the service name.
2. Check the key-policy or service-grant path.
3. Whether the account has an AWS Artifact report for the service.
4. Whether the data was moved to a larger EBS volume.

Correct Answer: B

 

Correct Answer

Answer B is correct because AWS services often require a key-policy authorization path or grant to use a customer managed key on behalf of a workload.

Incorrect Answers

Answer A is incorrect because Aliases are labels and do not grant service permission. It therefore does not satisfy the scenario’s decisive requirement: Workload IAM still allowed.

Answer C is incorrect because Compliance documents do not authorize cryptographic key use. It therefore does not satisfy the scenario’s decisive requirement: Workload IAM still allowed.

Answer D is incorrect because Storage capacity does not repair missing KMS service authorization. It therefore does not satisfy the scenario’s decisive requirement: Workload IAM still allowed.

 

Question 23

An application in us-west-2 tries to use the ARN of a single-Region KMS key that exists only in us-east-1 for a regional service integration that expects a local key. What design issue is most likely?

1. The key needs an ACM certificate so it can cross Regions over TLS.
2. The application must change the key alias to global.
3. The key must be made public so the other Region can discover it.
4. Use an appropriate key in the required Region.

Correct Answer: D

 

Correct Answer

Answer D is correct because KMS keys are Regional resources; a single-Region key cannot simply act as a local regional key in another Region.

Incorrect Answers

Answer A is incorrect because Certificates protect transport and do not change KMS key regional scope. It therefore does not satisfy the scenario’s decisive requirement: Regional service integration.

Answer B is incorrect because Aliases do not make a KMS key global or change its Region. It therefore does not satisfy the scenario’s decisive requirement: Regional service integration.

Answer C is incorrect because KMS keys are not made public for cross-Region use; access and regional architecture must be designed explicitly.

 

Question 24

A company uses multi-Region KMS keys for an application deployed in two Regions. The application expects each Region to use the local related key while preserving a common key relationship. Which statement is accurate?

1. Multi-Region keys remove the need to authorize decrypt operations.
2. The replica key can exist without any key policy because it inherits IAM permissions from the primary Region.
3. A single key ARN automatically resolves to whichever Region the request originates from.
4. Use each Region’s local related key ARN.

Correct Answer: D

 

Correct Answer

Answer D is correct because Multi-Region keys are related, but each primary or replica key exists in one Region and has its own ARN for regional use.

Incorrect Answers

Answer A is incorrect because Related key material does not bypass KMS permission checks. It therefore does not satisfy the scenario’s decisive requirement: Use local key in each Region.

Answer B is incorrect because Each regional KMS key has its own key policy and authorization context. It therefore does not satisfy the scenario’s decisive requirement: Use local key in each Region.

Answer C is incorrect because KMS key ARNs are Regional; applications do not get automatic geographic ARN resolution. It therefore does not satisfy the scenario’s decisive requirement: Use local key in each Region.

 

Question 25

A CloudFront distribution is configured for api.example.com. The team requested a valid ACM certificate for api.example.com in ap-southeast-2, but CloudFront cannot attach it. The same distribution serves a global audience. What should the team do?

1. Request or import the CloudFront certificate in us-east-1.
2. Move all viewers to ap-southeast-2 so the existing certificate becomes global.
3. Replace the certificate with a KMS symmetric key in ap-southeast-2.
4. Copy the ACM certificate to us-east-1 with an S3 replication rule.

Correct Answer: A

 

Correct Answer

Answer A is correct because CloudFront requires ACM viewer certificates to be in US East (N. Virginia), even when the origin or administrators are in another Region.

Incorrect Answers

Answer B is incorrect because Viewer geography does not change CloudFront’s ACM certificate Region requirement. It therefore does not satisfy the scenario’s decisive requirement: Global distribution.

Answer C is incorrect because A KMS data-encryption key cannot serve as the X.509 certificate required for CloudFront HTTPS.

Answer D is incorrect because ACM certificates are regional certificate resources and are not copied between Regions by S3 replication.