easyMultiple Choice
AIF-C01 Practice Question: Using Amazon Comprehend to analyze customer…
A company is using Amazon Comprehend to analyze customer feedback. They need to ensure that the documents are encrypted at rest. What should they do?
⚠ Common exam trap
Test-takers frequently assume they need to manually enable encryption or use KMS, but Amazon Comprehend enforces encryption at rest automatically with no user action required, making 'No action needed' the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No action is needed; Amazon Comprehend automatically encrypts data at rest using AES-256
Amazon Comprehend automatically encrypts all data at rest using AES-256 encryption by default, with no additional configuration required. This encryption covers both the documents processed by the service and any models or artifacts stored internally. Therefore, no action is needed from the customer to enable encryption at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No action is needed; Amazon Comprehend automatically encrypts data at rest using AES-256
Why this is correct
Amazon Comprehend encrypts data at rest by default using AES-256, with AWS-managed keys, so no customer configuration is required to meet the encryption requirement. This default behaviour satisfies the constraint without additional key management or bucket policies.
- ✗
Enable encryption using AWS KMS in the Comprehend console
Why it's wrong here
Comprehend does not offer a console setting that encrypts the source documents; it processes text supplied to it, and its own volume encryption is managed by AWS. KMS console options would be relevant for encrypting data within services that expose such settings, not for customer feedback documents.
- ✗
Store documents in an encrypted S3 bucket and use a VPC endpoint
Why it's wrong here
An encrypted S3 bucket protects the stored objects, but the VPC endpoint only governs network path, and neither encrypts the documents while Comprehend processes them. This combination suits restricting private connectivity to S3, not satisfying encryption at rest for the analysed content itself.
- ✗
Use SSL/TLS for all API calls to Comprehend
Why it's wrong here
SSL/TLS encrypts data in transit between the client and the Comprehend API endpoint, leaving stored documents unencrypted. It would be the right control when the requirement is protecting data on the wire, such as securing API calls over untrusted networks.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 862 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.