Explanation

Correct Answer: D - Server-side encryption with AWS KMS keys (SSE-KMS) with automatic rotation

Let's analyze each option against the requirements:

Requirements Analysis:

1. Encryption at rest - All options provide this
2. Encryption key usage must be logged for auditing - Only KMS provides detailed logging
3. Keys must be rotated every year - Requires key rotation capability
4. MOST operationally efficient - Minimizes manual effort

Option Analysis:

A. SSE-C (Customer-provided keys)

• ❌ No key usage logging - Customer manages keys, AWS doesn't log usage
• ❌ Manual key rotation - Customer must manually rotate keys
• ❌ Operationally inefficient - Customer manages key lifecycle

B. SSE-S3 (S3 managed keys)

• ❌ No key usage logging - S3 manages keys internally, no usage logs
• ❌ No key rotation - S3 doesn't rotate keys automatically
• ❌ No audit trail - Cannot track who accessed encrypted data

C. SSE-KMS with manual rotation

• ✅ Key usage logging - KMS logs all key usage via CloudTrail
• ✅ Key rotation possible - Can rotate manually
• ⚠️ Less operationally efficient - Requires manual rotation yearly

D. SSE-KMS with automatic rotation

• ✅ Key usage logging - KMS logs all key usage via CloudTrail
• ✅ Automatic key rotation - KMS can rotate keys automatically (every year)
• ✅ Most operationally efficient - Automated rotation reduces manual effort
• ✅ Compliance ready - Provides audit trail for compliance requirements

Key AWS KMS Features:

• CloudTrail Integration: Logs all KMS API calls including key usage
• Automatic Key Rotation: Can be enabled to rotate keys automatically every year
• Key Policies: Fine-grained access control
• Audit Trail: Complete visibility into who used keys and when

Why Not Other Options:

• SSE-C: Customer manages keys, no AWS logging
• SSE-S3: S3 manages keys internally, no audit trail
• Manual KMS rotation: Works but less efficient than automatic

Conclusion: SSE-KMS with automatic rotation meets all requirements while being the most operationally efficient solution.