CLF-C02 Security and Compliance Practice Question
A financial services company must encrypt all sensitive customer data stored in Amazon S3 using an encryption key that the company manages and rotates annually. The company also needs a complete, tamper-proof record of every time the key is used (including who used it and on which object) to satisfy regulatory audit requirements. Which AWS service should the company use to meet both the key management and audit logging requirements?
⚠ Common exam trap
Many exam-takers confuse AWS CloudHSM's hardware security with the integrated audit logging and automatic rotation capabilities of AWS KMS, assuming that a dedicated HSM is always required for regulatory compliance, when KMS with CloudTrail fully meets the tamper-proof audit requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (AWS KMS)
AWS KMS is the correct choice because it allows the company to create and manage a customer managed key (CMK) with annual rotation, and it integrates with AWS CloudTrail to deliver tamper-proof logs of every KMS API call (e.g., Decrypt, Encrypt, GenerateDataKey). These logs record the key ID, the IAM user or role that made the request, and the S3 object ARN (via encryption context), satisfying both key management and audit logging requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM is used to provision, manage, and deploy SSL/TLS certificates for use with AWS services like Elastic Load Balancing and CloudFront. It does not provide encryption keys for S3 object encryption nor does it log key usage events.
When this WOULD be correct
A company needs to automatically provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (like Elastic Load Balancing or CloudFront) and requires automatic renewal of those certificates.
- ✓
AWS Key Management Service (AWS KMS)
Why this is correct
KMS enables you to create and manage customer-managed keys (CMKs) for encrypting data at rest in S3. It also integrates with AWS CloudTrail to log every key usage request, providing the required audit trail for compliance.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM offers dedicated hardware security modules for customer-managed keys, appealing for its high security and FIPS 140-2 Level 3 compliance where exclusive control over key material is paramount. However, it fails to natively provide the detailed, tamper-proof audit logging of *key usage on specific S3 objects* that the scenario demands. While CloudHSM logs administrative actions, it does not integrate with CloudTrail to log every data encryption/decryption operation involving keys for S3 objects in the required granular detail.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager is designed to manage secrets such as database credentials, API keys, and passwords. It can automatically rotate secrets, but it is not used to create encryption keys for S3 objects or to log key usage events.
When this WOULD be correct
A company needs to automatically rotate secrets (e.g., database passwords) every 90 days and store them securely, with audit logging of secret access via AWS CloudTrail. Secrets Manager would be the correct choice for managing and rotating secrets, not encryption keys.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Key Management Service (AWS KMS)Correct answer▾
Why this is correct
KMS enables you to create and manage customer-managed keys (CMKs) for encrypting data at rest in S3. It also integrates with AWS CloudTrail to log every key usage request, providing the required audit trail for compliance.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) manages SSL/TLS certificates, not encryption keys for S3 data. It does not provide the key rotation or audit logging capabilities required for customer-managed encryption keys.
★ When this WOULD be the correct answer
A company needs to automatically provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (like Elastic Load Balancing or CloudFront) and requires automatic renewal of those certificates.
Why candidates choose this
Candidates may confuse ACM's certificate management with key management, or think that ACM provides encryption key services because it handles cryptographic certificates.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys for S3 data. It does not provide the required tamper-proof audit logs of key usage for regulatory compliance.
★ When this WOULD be the correct answer
A company needs to automatically rotate secrets (e.g., database passwords) every 90 days and store them securely, with audit logging of secret access via AWS CloudTrail. Secrets Manager would be the correct choice for managing and rotating secrets, not encryption keys.
Why candidates choose this
Candidates may confuse Secrets Manager's secret rotation and audit capabilities with the key management and audit requirements of KMS, assuming it can also manage encryption keys for S3.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.