CLF-C02 Security and Compliance Practice Question
A company processes credit card transactions and must comply with PCI DSS requirements. Customer payment data is stored in Amazon RDS for MySQL. The security team needs to ensure that all automated database snapshots are encrypted at rest using customer-managed encryption keys that are automatically rotated every 365 days. The team wants a fully managed AWS service to create and control these encryption keys. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse CloudHSM's hardware-based key control with KMS's fully managed key rotation and integration, assuming that any HSM service automatically handles key rotation, when in fact CloudHSM requires you to implement rotation logic yourself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (AWS KMS)
AWS KMS is the correct service because it provides a fully managed, centralized way to create and control customer-managed keys (CMKs) that can be used to encrypt Amazon RDS automated snapshots. KMS supports automatic annual key rotation (365 days) as a built-in feature, and it integrates directly with RDS to enforce encryption at rest for snapshots without requiring any manual key management. This meets the PCI DSS requirement for customer-controlled encryption keys with automated rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Key Management Service (AWS KMS)
Why this is correct
AWS KMS is the correct service because it is a fully managed key management service that creates and controls customer master keys (CMKs) used for data-at-rest encryption. It supports automatic annual rotation of key material, which satisfies the compliance requirement, and its integration with Amazon RDS lets you encrypt DB instances and snapshots transparently. When you enable RDS encryption, AWS KMS keys are used to encrypt the storage, automated backups, and snapshots, so the key rotation requirements are met without manual overhead.
- ✗
AWS CloudHSM
Why it's wrong here
Incorrect. AWS CloudHSM provides dedicated hardware security modules (HSMs), but it is not a fully managed service for automatic key rotation. It requires the customer to manage key rotation manually, which does not meet the requirement for automatic rotation.
When this WOULD be correct
A company needs to manage its own HSM for regulatory compliance (e.g., FIPS 140-2 Level 3) and requires dedicated, single-tenant hardware for cryptographic operations, with full control over key lifecycle and no automatic rotation.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is designed to store and rotate secrets such as database credentials and API keys, not to manage customer master keys for encrypting data at rest. While Secrets Manager uses KMS keys to encrypt the secrets it stores, it does not provide the key-management controls required for RDS snapshot encryption. Choosing it would fail the requirement because it does not control or rotate the encryption keys used by RDS or other AWS storage services.
When this WOULD be correct
A company needs to automatically rotate database credentials stored in a secure service, and wants to centrally manage access to those credentials with fine-grained audit logging. AWS Secrets Manager would be the correct service to store and rotate the credentials.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager (ACM) handles the lifecycle of public and private SSL/TLS certificates used to encrypt network traffic in transit, such as HTTPS connections to load balancers or CloudFront distributions. It does not create or manage symmetric data-encryption keys used for data at rest, and it has no role in encrypting RDS snapshots. Because the compliance requirement concerns key rotation for storage encryption, ACM is unrelated to the key-management function needed here.
When this WOULD be correct
A company needs to issue and renew SSL/TLS certificates for a web application hosted on an Application Load Balancer, and wants a fully managed service to automate certificate provisioning and renewal.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Key Management Service (AWS KMS)Correct answer▾
Why this is correct
AWS KMS is the correct service because it is a fully managed key management service that creates and controls customer master keys (CMKs) used for data-at-rest encryption. It supports automatic annual rotation of key material, which satisfies the compliance requirement, and its integration with Amazon RDS lets you encrypt DB instances and snapshots transparently. When you enable RDS encryption, AWS KMS keys are used to encrypt the storage, automated backups, and snapshots, so the key rotation requirements are met without manual overhead.
✗AWS CloudHSMWrong answer — click to see why▾
Why this is wrong here
AWS CloudHSM provides hardware security modules (HSMs) but is not a fully managed service for creating and controlling encryption keys with automatic rotation; it requires manual key management and does not integrate directly with RDS for automated snapshot encryption.
★ When this WOULD be the correct answer
A company needs to manage its own HSM for regulatory compliance (e.g., FIPS 140-2 Level 3) and requires dedicated, single-tenant hardware for cryptographic operations, with full control over key lifecycle and no automatic rotation.
Why candidates choose this
Candidates may confuse CloudHSM with KMS because both offer encryption key management, but CloudHSM is often seen as more secure for compliance, leading to its selection despite the requirement for a fully managed, automatically rotating key service.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed to manage secrets like database credentials, not to create or control encryption keys. It does not provide customer-managed key rotation or direct encryption key management for RDS snapshots.
★ When this WOULD be the correct answer
A company needs to automatically rotate database credentials stored in a secure service, and wants to centrally manage access to those credentials with fine-grained audit logging. AWS Secrets Manager would be the correct service to store and rotate the credentials.
Why candidates choose this
Candidates may confuse 'managing secrets' with 'managing encryption keys', or think that Secrets Manager can handle key rotation because it supports automatic rotation of secrets.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) manages SSL/TLS certificates for securing network communications, not encryption keys for data at rest. It cannot create or control customer-managed encryption keys for RDS snapshots.
★ When this WOULD be the correct answer
A company needs to issue and renew SSL/TLS certificates for a web application hosted on an Application Load Balancer, and wants a fully managed service to automate certificate provisioning and renewal.
Why candidates choose this
Candidates may confuse encryption of data in transit (certificates) with encryption of data at rest (keys), or think ACM handles all encryption-related tasks due to the word 'certificate' implying security.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.