CLF-C02 Security and Compliance Practice Question
A company stores sensitive customer data in Amazon S3 buckets. The company's security policy requires that all objects in these buckets be encrypted at rest using an encryption key that the company can rotate annually and audit for usage. The company also needs to control which IAM users and roles can use, create, and manage these keys. The security team wants to use an AWS managed service to handle the key management lifecycle. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Candidates often confuse AWS Secrets Manager with KMS because both manage secrets, but Secrets Manager is for rotating application secrets like database passwords, not for managing encryption keys used for S3 server-side encryption, which is a core KMS function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is the correct choice because it is a managed service that allows you to create, rotate, and audit customer-managed keys (CMKs) used for encrypting S3 objects at rest. KMS integrates with AWS CloudTrail to log every key usage, enabling the required audit trail, and supports annual key rotation via automatic or manual rotation. It also provides fine-grained IAM policies and key policies to control which users and roles can use, create, and manage the keys, meeting all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Key Management Service (KMS)
Why this is correct
AWS KMS is a managed encryption service that lets you create customer managed keys (CMKs) used to encrypt data at rest in Amazon S3. It integrates with S3's server-side encryption (SSE-KMS) to encrypt objects transparently, and provides centralized control over key policies, automatic annual rotation, and AWS CloudTrail auditing of key usage. This gives the company a fully managed key infrastructure without having to implement or operate their own key management hardware.
- ✗
Amazon S3 server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C lets you provide your own encryption key with each S3 PUT request, and S3 applies that key to encrypt the object and discards the key after the operation. The customer is fully responsible for generating, storing, rotating, and safeguarding those keys; AWS does not manage them. Since the company wants AWS to handle key management, SSE-C would shift that burden back to the customer and is therefore not the right choice.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM provisions and manages public and private SSL/TLS certificates used to encrypt network traffic in transit, such as HTTPS connections to CloudFront or Application Load Balancers. It does not generate or manage symmetric data encryption keys used for encrypting objects at rest in S3, and ACM certificates cannot be applied to S3 bucket encryption. Therefore, ACM would not provide any data-at-rest encryption key management for the stored customer data.
When this WOULD be correct
A company needs to issue and manage SSL/TLS certificates for a web application running on an Application Load Balancer, with automatic renewal and integration with AWS services. ACM would be the correct service to manage the certificate lifecycle.
- ✗
AWS Secrets Manager
Why it's wrong here
Incorrect. AWS Secrets Manager is designed to manage secrets such as database credentials and API keys. While it can help with key rotation, it is not the primary service for managing encryption keys for data at rest in Amazon S3.
When this WOULD be correct
A company needs to automatically rotate database credentials stored in a secure service and audit access to those credentials. AWS Secrets Manager would be the correct choice for managing and rotating secrets such as RDS passwords or API tokens.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Key Management Service (KMS)Correct answer▾
Why this is correct
AWS KMS is a managed encryption service that lets you create customer managed keys (CMKs) used to encrypt data at rest in Amazon S3. It integrates with S3's server-side encryption (SSE-KMS) to encrypt objects transparently, and provides centralized control over key policies, automatic annual rotation, and AWS CloudTrail auditing of key usage. This gives the company a fully managed key infrastructure without having to implement or operate their own key management hardware.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) handles SSL/TLS certificates for securing network traffic, not encryption keys for data at rest in S3. It does not provide key rotation or audit capabilities for S3 object encryption.
★ When this WOULD be the correct answer
A company needs to issue and manage SSL/TLS certificates for a web application running on an Application Load Balancer, with automatic renewal and integration with AWS services. ACM would be the correct service to manage the certificate lifecycle.
Why candidates choose this
Candidates may confuse certificate management with key management, as both involve cryptographic materials and lifecycle management, leading them to select ACM for encryption key requirements.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys with rotation and audit capabilities. It does not provide the key management lifecycle features required for encrypting S3 objects.
★ When this WOULD be the correct answer
A company needs to automatically rotate database credentials stored in a secure service and audit access to those credentials. AWS Secrets Manager would be the correct choice for managing and rotating secrets such as RDS passwords or API tokens.
Why candidates choose this
Candidates may confuse Secrets Manager with KMS because both involve managing sensitive data and have 'secrets' in their name, leading them to think Secrets Manager can handle encryption key management.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.