CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Certificate Manager (ACM)

  Why this is correct

  AWS Certificate Manager is the correct service because it natively provisions, manages, and deploys public and private SSL/TLS certificates to integrated AWS services, including Application Load Balancers. ACM automates certificate renewal and handles domain validation, eliminating the manual overhead of tracking expiration dates and uploading replacements. Once a certificate is associated with an ALB, ACM continues to manage the certificate lifecycle without requiring administrator intervention.

• ✗

  AWS Key Management Service (AWS KMS)

  Why it's wrong here

  AWS KMS is a service for creating and managing customer master keys and symmetric/asymmetric encryption keys that protect data at rest; it does not handle SSL/TLS certificates used for encryption in transit. While KMS can technically encrypt the private key of a certificate stored elsewhere, it cannot deploy that certificate to an Application Load Balancer or automatically renew it. Therefore, KMS is not designed for the certificate management tasks described in the scenario.

  When this WOULD be correct

  A company needs to centrally manage encryption keys used to encrypt data stored in Amazon S3, RDS, or EBS volumes, and requires automatic key rotation and integration with AWS services for envelope encryption.

• ✗

  AWS Secrets Manager

  Why it's wrong here

  AWS Secrets Manager is focused on securely storing and automatically rotating secrets such as database credentials, API keys, and third-party tokens; SSL/TLS certificates do not fall under its standard rotation logic. Although you could temporarily store a certificate as a secret, Secrets Manager has no native integration to associate the certificate with an ALB or to renew it via ACM's Domain Validation process. Its rotation mechanism is built for custom Lambda-based rotations of credentials, not for certificate lifecycle management, making it an incorrect answer here.

  When this WOULD be correct

  A company needs to rotate database credentials automatically and securely store API keys for a microservices application. AWS Secrets Manager would be the correct service to manage these secrets with automatic rotation and fine-grained access control.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  IAM does not manage SSL/TLS certificate lifecycle tasks such as automatic renewal or deployment to an ALB; it only stores and controls access to certificates as IAM server certificates, which must be manually uploaded and replaced. It is tempting because IAM is a centralised access control service, and in scenarios requiring only static certificate storage with manual rotation, it would be a valid choice.

  When this WOULD be correct

  A company needs to control which AWS resources and actions are authorized for specific users or services, such as granting an EC2 instance permission to access an S3 bucket. IAM would be the correct service for defining these permissions.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question