The correct choice is SSE-C. Amazon S3 will reject requests sent over plain HTTP when you use customer provided keys because the key material is transmitted in request headers and must be protected in transit.

With SSE-C the client supplies the encryption key with each request and S3 enforces transport layer security to protect that key. For this reason S3 requires HTTPS for SSE-C requests and will refuse requests that arrive over HTTP.

SSE-KMS uses AWS KMS to manage keys for server side encryption at rest and it does not by itself make S3 reject HTTP requests. HTTPS is strongly recommended and AWS SDKs use it by default but the presence of SSE-KMS is not what enforces rejection.

Client-side encryption means data is encrypted before it is uploaded so S3 never receives the unencrypted key material to protect. S3 does not enforce transport requirements based on client side encryption and it will not automatically refuse HTTP requests for this reason.

SSE-S3 uses S3 managed keys for encryption at rest and it does not mandate HTTPS at the API level. S3 will accept requests when SSE-S3 is used though using HTTPS is best practice for all uploads.

Full AWS Practitioner Certification Question