CLF-C02 Security and Compliance Practice Question
A company operates a healthcare application on AWS that must comply with HIPAA regulations. The application stores sensitive patient data in Amazon S3. The compliance team requires that all data at rest in S3 be encrypted with a key that the company manages. The company also needs the ability to automatically rotate the encryption key every 365 days and to audit all key usage through AWS CloudTrail. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Candidates often confuse AWS CloudHSM (which offers dedicated HSM control) with KMS's simpler managed rotation and auditing, overlooking that CloudHSM requires manual rotation and lacks native CloudTrail integration for key usage logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (KMS) with a customer managed key
AWS KMS with a customer managed key (CMK) allows the company to create and control the encryption key used for S3 server-side encryption, meeting HIPAA's requirement for customer-managed keys. KMS supports automatic key rotation every 365 days (or custom period) and integrates with AWS CloudTrail to log every key usage (e.g., Decrypt, Encrypt API calls) for auditing. This combination satisfies all stated requirements: encryption at rest, customer-managed key, automatic rotation, and auditability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM is used to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services. It does not provide encryption keys for data at rest or support key rotation for S3 objects.
When this WOULD be correct
A company needs to issue, manage, and automatically renew public or private SSL/TLS certificates for securing network traffic to an AWS load balancer or CloudFront distribution, with integration for certificate deployment.
- ✓
AWS Key Management Service (KMS) with a customer managed key
Why this is correct
KMS with a customer managed key enables you to create and control the lifecycle of encryption keys. Automatic key rotation every 365 days is supported for customer managed keys, and all key usage is recorded in CloudTrail for auditing.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM provides dedicated hardware security modules (HSMs) for key generation and storage. However, automatic key rotation is not a built-in feature of CloudHSM; you would need to implement custom automation to rotate keys, which adds complexity.
When this WOULD be correct
A company must store encryption keys in a dedicated, FIPS 140-2 Level 3 validated hardware security module (HSM) and requires full control over key management without AWS having access to the keys. The company does not need automatic key rotation or CloudTrail integration for key usage.
- ✗
Amazon S3 server-side encryption with S3-managed keys (SSE-S3)
Why it's wrong here
SSE-S3 encrypts data at rest using keys managed by AWS. The customer does not have control over key rotation or visibility into key usage logs, and the keys are rotated automatically by AWS without customer intervention or customization.
When this WOULD be correct
If the question required encryption at rest with minimal management overhead and no need for customer-managed keys or key rotation, SSE-S3 would be correct. For example, a non-sensitive application where AWS-managed keys are acceptable and compliance does not mandate customer control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Key Management Service (KMS) with a customer managed keyCorrect answer▾
Why this is correct
KMS with a customer managed key enables you to create and control the lifecycle of encryption keys. Automatic key rotation every 365 days is supported for customer managed keys, and all key usage is recorded in CloudTrail for auditing.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
ACM manages SSL/TLS certificates for encryption in transit, not encryption at rest. It does not provide key management for S3 data encryption or key rotation capabilities.
★ When this WOULD be the correct answer
A company needs to issue, manage, and automatically renew public or private SSL/TLS certificates for securing network traffic to an AWS load balancer or CloudFront distribution, with integration for certificate deployment.
Why candidates choose this
Candidates may confuse certificate management for encryption in transit with key management for encryption at rest, or assume ACM handles all encryption needs on AWS.
✗AWS CloudHSMWrong answer — click to see why▾
Why this is wrong here
AWS CloudHSM provides hardware-based key storage but does not offer automatic key rotation or native integration with AWS CloudTrail for key usage auditing. The question requires automatic rotation every 365 days and CloudTrail auditing, which are features of AWS KMS, not CloudHSM.
★ When this WOULD be the correct answer
A company must store encryption keys in a dedicated, FIPS 140-2 Level 3 validated hardware security module (HSM) and requires full control over key management without AWS having access to the keys. The company does not need automatic key rotation or CloudTrail integration for key usage.
Why candidates choose this
Candidates may think CloudHSM is required for HIPAA compliance due to its high security level, or they may confuse the need for customer-managed keys with the need for dedicated hardware, not realizing that KMS customer managed keys meet the requirements without the operational overhead of CloudHSM.
✗Amazon S3 server-side encryption with S3-managed keys (SSE-S3)Wrong answer — click to see why▾
Why this is wrong here
SSE-S3 uses encryption keys managed entirely by AWS, not by the customer. The requirement specifies that the company must manage the encryption key, and SSE-S3 does not provide customer-managed key rotation or auditing via CloudTrail.
★ When this WOULD be the correct answer
If the question required encryption at rest with minimal management overhead and no need for customer-managed keys or key rotation, SSE-S3 would be correct. For example, a non-sensitive application where AWS-managed keys are acceptable and compliance does not mandate customer control.
Why candidates choose this
Candidates may confuse SSE-S3 with server-side encryption options that support customer keys, or assume that S3 encryption alone meets HIPAA requirements without considering key management and auditing needs.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.