easyMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: Using Amazon Comprehend to analyze customer…
A company is using Amazon Comprehend to analyze customer feedback. They need to ensure that the documents are encrypted at rest. What should they do?
⚠ Common exam trap
Test-takers frequently assume they need to manually enable encryption or use KMS, but Amazon Comprehend enforces encryption at rest automatically with no user action required, making 'No action needed' the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No action is needed; Amazon Comprehend automatically encrypts data at rest using AES-256
Amazon Comprehend automatically encrypts all data at rest using AES-256 encryption by default, with no additional configuration required. This encryption covers both the documents processed by the service and any models or artifacts stored internally. Therefore, no action is needed from the customer to enable encryption at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No action is needed; Amazon Comprehend automatically encrypts data at rest using AES-256
Why this is correct
Comprehend encrypts all data at rest by default.
- ✗
Enable encryption using AWS KMS in the Comprehend console
Why it's wrong here
Comprehend does not have a console setting for encryption; it's automatic.
- ✗
Store documents in an encrypted S3 bucket and use a VPC endpoint
Why it's wrong here
While S3 encryption is good, Comprehend encrypts at rest by default regardless of S3 encryption.
- ✗
Use SSL/TLS for all API calls to Comprehend
Why it's wrong here
SSL/TLS encrypts data in transit, not at rest.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.