Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**SSE-S3**: S3 manages keys. Transparent; no audit of key usage. Cheapest. Use when compliance doesn't require key audit. **SSE-KMS**: KMS manages keys. CloudTrail logs every encrypt/decrypt. Customer-managed keys (CMK) allow rotation, policy. Use when compliance requires audit...
This easy-level Cloud/Tools question appears frequently in data engineering interviews at companies like Capco. While less common, it tests deeper understanding that distinguishes strong candidates.
Start by clearly defining the core concept being asked about. Interviewers want to see that you understand the fundamentals before diving into implementation details. Structure your answer with a definition, then explain the practical application with a concise example.
SSE-S3: S3 manages keys. Transparent; no audit of key usage. Cheapest. Use when compliance doesn't require key audit. SSE-KMS: KMS manages keys. CloudTrail logs every encrypt/decrypt. Customer-managed keys (CMK) allow rotation, policy. Use when compliance requires audit (HIPAA, PCI). SSE-C: Customer provides key per request. S3 does not store key. You manage key lifecycle. Use for maximum control; operational burden. Trade-off: SSE-KMS adds cost ($0.03/10K requests) and slight latency. For compliance, it's required. Scalability: KMS has 10K req/s limit per key; high-throughput needs caching or multiple keys. Best practice: Default SSE-S3; enforce SSE-KMS via bucket policy for sensitive buckets. Use CMK for regulated data.
Pro-Move: 'We enforce SSE-KMS via SCP for all buckets in our workload OU—compliance team can audit every encrypt/decrypt in CloudTrail.' Red Flag: Not knowing that SSE-KMS enables audit—critical for regulated industries.
Some links below are affiliate links. If you buy through them we may earn a small commission at no extra cost to you — it helps keep DataEngPrep free.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.