CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Key Management Service (AWS KMS)

  Why this is correct

  AWS KMS provides customer managed keys (CMKs) that can be used with S3 server-side encryption (SSE-KMS). KMS supports automatic annual rotation of these keys, which directly meets the 'data at rest encrypted with regularly rotated keys' requirement while allowing you to maintain full control over key policies and access permissions. Unlike simpler encryption options, KMS also provides audit trails through CloudTrail integrated actions, giving compliance teams evidence of key usage and rotation. This is why KMS is the correct answer for a compliance policy mandating encryption key rotation.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs) that let you perform cryptographic operations using keys you fully control within a FIPS 140-2 Level 3 validated environment. While CloudHSM can store encryption keys, it does not offer an automatic key rotation feature; you must implement custom rotation logic and manage the rotated keys manually or through your own scripts. This makes it operationally complex to meet a simple 'auto-rotate annually' compliance policy, and it is not commonly used for automatic S3 encryption key rotation. The lack of native rotation is the primary reason CloudHSM is not the best choice here.

  When this WOULD be correct

  A company needs to store encryption keys in a dedicated hardware security module (HSM) under their sole control, with no AWS access to the keys, and is willing to manage key rotation manually or via custom scripts.

• ✗

  AWS Secrets Manager

  Why it's wrong here

  AWS Secrets Manager is designed to rotate secrets such as database credentials, API keys, and other authentication tokens throughout their lifecycle. Although it does use KMS to encrypt secrets at rest, it does not directly manage customer master keys for S3 object encryption, nor does it integrate with S3's server-side encryption options. Its rotation capability is scoped to the secret value itself, not to the cryptographic keys protecting data at rest. Thus, Secrets Manager is not an appropriate service for enforcing S3 encryption key rotation under a compliance policy.

  When this WOULD be correct

  A company needs to automatically rotate database credentials stored in a secure service, with built-in integration for RDS, Redshift, and DocumentDB. AWS Secrets Manager would be the correct choice for managing and rotating those secrets.

• ✗

  AWS Certificate Manager

  Why it's wrong here

  AWS Certificate Manager provisions and manages public/private SSL/TLS certificates used to encrypt network traffic in transit, not to encrypt objects at rest in Amazon S3. The service handles certificate issuance, renewal, and deployment to load balancers, CloudFront, or API Gateway, but it never generates or manages data encryption keys for S3 objects. It also does not provide any rotation mechanism for S3 encryption keys. Therefore, ACM cannot satisfy a compliance policy that requires data at rest encryption key rotation in S3.

  When this WOULD be correct

  A company needs to automatically renew and deploy SSL/TLS certificates for its web applications hosted on AWS, and wants AWS to handle certificate renewal without manual intervention.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question