CLF-C02 Security and Compliance Practice Question
A company stores sensitive customer data in Amazon S3. The security policy requires that all objects be encrypted at rest using an encryption key that is automatically rotated every 12 months. The company must retain full control over the key, including the ability to immediately revoke access to the key if a security incident occurs. The security team also needs to audit every use of the key through AWS CloudTrail. Which key management solution should the company choose to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse AWS managed keys (which also rotate automatically) with customer managed keys, overlooking the requirement for full customer control and immediate revocation capability that only customer managed keys provide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an AWS KMS customer managed key (CMK) with automatic key rotation enabled.
AWS KMS customer managed keys (CMKs) allow you to enable automatic annual key rotation (every 12 months) and retain full control over the key, including the ability to immediately revoke access by disabling or deleting the key. CloudTrail integration is inherent with KMS, logging every use of the key via the `Decrypt` and `GenerateDataKey` API calls, meeting the audit requirement. This combination satisfies all stated security policy needs: encryption at rest, automatic rotation, full control, immediate revocation, and auditability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an AWS KMS customer managed key (CMK) with automatic key rotation enabled.
Why this is correct
A customer managed CMK is ideal here because it places the key lifecycle under your direct control: you can enable automatic rotation (default is yearly), set custom key policies and grants, and revoke access at any time. Every use of the key to encrypt or decrypt S3 objects is recorded in AWS CloudTrail, which gives auditors a verifiable trail of who accessed the data. KMS also integrates natively with S3, so encryption is applied transparently when writing objects.
- ✗
Use an AWS KMS AWS managed key with automatic key rotation.
Why it's wrong here
An AWS managed KMS key is indeed configured with automatic rotation by AWS, but you cannot customize that schedule, view the key policy, or disable/delete the key. You also cannot restrict which IAM principals are allowed to use the key, because the service (in this case S3) controls the policy and AWS manages the key material. While CloudTrail does log KMS operations for AWS managed keys, you lack the administrative control and granular permission management needed for a security-sensitive data repository.
When this WOULD be correct
If the requirement is to encrypt data at rest with minimal management overhead and automatic rotation is acceptable, but the customer does not need full control over the key or the ability to revoke it immediately, an AWS managed key would be appropriate.
- ✗
Use Amazon S3 server-side encryption with SSE-S3.
Why it's wrong here
SSE-S3 encrypts objects with AES-256 using keys that S3 owns and rotates on a regular schedule, but those details are entirely outside your control. You cannot define key policies, grants, or separate roles for decryption, nor can you revoke individual keys or trace key usage through CloudTrail, since S3-managed keys are not exposed to your account. For sensitive customer data that requires auditability and explicit access control, this option fails to meet the compliance bar.
When this WOULD be correct
A company needs server-side encryption for S3 objects at rest with minimal management overhead, no requirement for customer-controlled key rotation, and no need for CloudTrail auditing of key usage. SSE-S3 provides automatic encryption with S3-managed keys.
- ✗
Use AWS CloudHSM to generate and manage the key.
Why it's wrong here
CloudHSM gives you dedicated hardware security modules and physical control over key generation, but it does not natively provide automatic key rotation; you must build your own rotation workflow, including retiring and replacing keys. Additionally, the HSM operations are not logged via CloudTrail with the same rich integration that KMS offers; you would have to set up separate HSM audit logging and correlate it manually. This makes CloudHSM operationally heavy and audited differently, making KMS the better fit for this scenario.
When this WOULD be correct
A company requires a dedicated hardware security module (HSM) to generate and manage keys for regulatory compliance (e.g., FIPS 140-2 Level 3), and is willing to implement manual key rotation and separate auditing mechanisms (e.g., using CloudHSM logs with custom integration).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an AWS KMS customer managed key (CMK) with automatic key rotation enabled.Correct answer▾
Why this is correct
A customer managed CMK is ideal here because it places the key lifecycle under your direct control: you can enable automatic rotation (default is yearly), set custom key policies and grants, and revoke access at any time. Every use of the key to encrypt or decrypt S3 objects is recorded in AWS CloudTrail, which gives auditors a verifiable trail of who accessed the data. KMS also integrates natively with S3, so encryption is applied transparently when writing objects.
✗Use an AWS KMS AWS managed key with automatic key rotation.Wrong answer — click to see why▾
Why this is wrong here
AWS managed keys do not allow customers to control key rotation, view key metadata, or manage key policies, and they cannot be immediately revoked or deleted by the customer.
★ When this WOULD be the correct answer
If the requirement is to encrypt data at rest with minimal management overhead and automatic rotation is acceptable, but the customer does not need full control over the key or the ability to revoke it immediately, an AWS managed key would be appropriate.
Why candidates choose this
Candidates may confuse AWS managed keys with customer managed keys, assuming both offer the same level of control and auditability, or they may think that automatic rotation is the only requirement.
✗Use Amazon S3 server-side encryption with SSE-S3.Wrong answer — click to see why▾
Why this is wrong here
SSE-S3 uses S3-managed keys, which do not allow customer control, automatic rotation every 12 months, or auditing through CloudTrail. The question requires customer-managed keys with full control and auditability.
★ When this WOULD be the correct answer
A company needs server-side encryption for S3 objects at rest with minimal management overhead, no requirement for customer-controlled key rotation, and no need for CloudTrail auditing of key usage. SSE-S3 provides automatic encryption with S3-managed keys.
Why candidates choose this
Candidates may assume SSE-S3 meets encryption requirements because it encrypts data at rest, but they overlook the specific needs for customer control, key rotation, and auditing.
✗Use AWS CloudHSM to generate and manage the key.Wrong answer — click to see why▾
Why this is wrong here
AWS CloudHSM does not provide automatic key rotation; key rotation must be managed manually. Additionally, CloudHSM does not integrate with AWS CloudTrail for key usage auditing, as it lacks native key usage logging.
★ When this WOULD be the correct answer
A company requires a dedicated hardware security module (HSM) to generate and manage keys for regulatory compliance (e.g., FIPS 140-2 Level 3), and is willing to implement manual key rotation and separate auditing mechanisms (e.g., using CloudHSM logs with custom integration).
Why candidates choose this
Candidates may think CloudHSM offers more control and security for sensitive data, and may overlook the specific requirements for automatic rotation and CloudTrail auditing, assuming CloudHSM can meet all key management needs.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company stores sensitive financial data in Amazon S3 and must encrypt it at rest. The compliance team mandates that the encryption key must be rotated at least once per year, and the key material must be generated and managed by the company within AWS. The company wants a fully automated solution that requires no manual intervention for key rotation. Which AWS service or feature should the company use?
medium- A.Use Amazon S3 server-side encryption with customer-provided encryption keys (SSE-C).
- ✓ B.Create an AWS KMS customer managed key and enable automatic annual rotation.
- C.Use an AWS KMS AWS managed key (aws/s3) which automatically rotates the key every year.
- D.Use AWS CloudHSM to generate and manage the key, and implement a custom cron job to rotate the key.
Why B: AWS KMS customer managed keys support automatic annual rotation, which satisfies the compliance requirement for key rotation without manual intervention. The company retains control over the key material since it is generated and managed within AWS KMS, meeting the mandate that the company manages the keys within AWS.
Variation 2. A company stores sensitive financial data in Amazon S3. They need to ensure that even if an attacker gains access to the S3 service, they cannot read the data without a customer-controlled encryption key. Which S3 encryption method satisfies this requirement?
hard- A.SSE-S3 (Amazon S3-managed keys)
- B.SSE-KMS with an AWS managed CMK (aws/s3)
- ✓ C.SSE-KMS with a customer-managed CMK
- D.S3 Versioning with MFA Delete
Why C: SSE-KMS with a customer-managed CMK ensures that the encryption key is under the customer's exclusive control, not AWS. Even if an attacker gains access to the S3 service, they cannot decrypt the data without the customer-managed CMK, which is stored in AWS KMS and can be further protected with key policies, IAM policies, and optional key rotation. This satisfies the requirement that the attacker cannot read the data without a customer-controlled encryption key.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.