CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Amazon S3 server-side encryption with customer-provided encryption keys (SSE-C).

  Why it's wrong here

  With SSE-C, you must supply a raw encryption key in each S3 request header, and S3 uses that key to encrypt or decrypt the object and then discards the key, so you are responsible for storing, securing, and tracking every key outside of AWS. There is no native rotation capability; rotating encryption keys would require you to download and re-upload every affected object with a new key, an entirely manual and highly error-prone process that scales poorly. Moreover, SSE-C never passes through AWS KMS, so you gain no centralized key policy, audit trail, or automated expiration. Thus, although SSE-C permits company-managed keys, it fails the automated annual rotation requirement and creates significant operational overhead.

  When this WOULD be correct

  If the compliance team required the company to manage and rotate encryption keys outside of AWS, and manual key rotation was acceptable, SSE-C would be appropriate.

• ✓

  Create an AWS KMS customer managed key and enable automatic annual rotation.

  Why this is correct

  A customer-managed KMS key gives you full control over the key, including its key policy, aliases, and lifecycle, while automatic key rotation in AWS KMS generates new cryptographic key material every year and retains the previous material so existing ciphertext remains decryptable. The key ID, ARN, and CMK metadata do not change, so S3 encryption and IAM policies continue to work without any object rewrites. Because you own the key and KMS handles the annual rotation automatically, this option meets both the company-managed requirement and the need for a low-overhead, fully supported rotation mechanism.

• ✗

  Use an AWS KMS AWS managed key (aws/s3) which automatically rotates the key every year.

  Why it's wrong here

  AWS managed keys rotate automatically, but they are managed by AWS on your behalf. The scenario states the company must generate and manage the key itself, so an AWS managed key does not satisfy the requirement of company management.

  When this WOULD be correct

  If the question required encryption at rest with no specific rotation schedule, or if the compliance requirement was simply that AWS manages the key automatically without a fixed rotation interval, then using an AWS managed key (aws/s3) would be correct.

• ✗

  Use AWS CloudHSM to generate and manage the key, and implement a custom cron job to rotate the key.

  Why it's wrong here

  AWS CloudHSM provides a hardware security module for key generation, but rotation would require building and maintaining a custom solution (e.g., a cron job) to rotate the key. This is not fully automated as a native AWS feature and introduces operational overhead.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question