A personal finance app stores sensitive financial files in Amazon S3 and requires server-side encryption. The company does not want to supply its own keys, but it needs an audit trail showing who used the key and when. Which encryption option meets these needs?

SSE-KMS is the correct choice because it provides server-side encryption using keys managed by AWS Key Management Service (KMS). This meets the requirement for server-side encryption without the company supplying its own keys. Crucially, KMS integrates with AWS CloudTrail, providing an audit trail of key usage, including who used the key and when, which directly addresses the audit trail requirement. Client-side encryption (first option) doesn't meet the server-side encryption requirement. SSE-S3 (second option) uses AWS-managed keys but does not provide the detailed audit trail of key usage that KMS offers. SSE-C (third option) requires the customer to provide and manage their own encryption keys, which the company explicitly wants to avoid.