CLF-C02 Security and Compliance Practice Question
A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse SSE-C with customer managed keys in KMS, assuming that providing your own key (SSE-C) gives you full control and auditability, but SSE-C lacks automatic rotation and integrated auditing, which KMS provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.
AWS KMS with a customer managed key allows the company to maintain full control over the encryption keys, enable automatic annual rotation, and provides detailed CloudTrail audit logs for every key usage, including the AWS principal that made the request. This satisfies the compliance requirements for encryption at rest, key rotation, and audit trail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.
Why it's wrong here
SSE-C requires you to supply your own encryption keys with each request. AWS Secrets Manager can rotate secrets, but it does not directly manage S3 key material or provide integration with S3 for automatic key rotation. Additionally, SSE-C does not integrate with AWS CloudTrail for auditing key usage at the key level.
When this WOULD be correct
This option would be correct if the requirement was to use encryption keys that are not stored in AWS (e.g., due to a mandate that keys must be kept on-premises) and the company had a separate mechanism to rotate keys and audit usage, such as a custom solution using AWS CloudTrail and Secrets Manager.
- ✗
Use Amazon S3 server-side encryption with AWS managed keys (SSE-S3) and enable automatic key rotation.
Why it's wrong here
AWS managed keys (aws/s3) are owned and managed by AWS. You do not have full control over the key material, and automatic rotation is handled by AWS but is not configurable or auditable at the customer level.
- ✗
Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.
Why it's wrong here
CloudHSM provides dedicated hardware security modules, but it does not provide built-in automatic key rotation. You would need to build custom rotation logic, and auditing key usage across many principals would require significant custom integration.
When this WOULD be correct
A scenario where the compliance policy requires the encryption keys to be stored in a hardware security module (HSM) under the company's direct control, and the company is willing to build custom rotation and logging mechanisms. For example, a company that must meet FIPS 140-2 Level 3 validation and has a dedicated team to manage key lifecycle and audit logging.
- ✓
Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.
Why this is correct
AWS KMS customer managed keys give you full control over the key material and key policy. You can enable automatic annual rotation, and all key usage is logged in AWS CloudTrail, providing a detailed audit trail of which principal used the key.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.Correct answer▾
Why this is correct
AWS KMS customer managed keys give you full control over the key material and key policy. You can enable automatic annual rotation, and all key usage is logged in AWS CloudTrail, providing a detailed audit trail of which principal used the key.
✗Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.Wrong answer — click to see why▾
Why this is wrong here
SSE-C does not provide automatic key rotation; the customer must manage key rotation themselves. Additionally, SSE-C does not provide a detailed audit trail of key usage by AWS principal, as it only logs that an object was encrypted with a customer-provided key, not which key or principal used it.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to use encryption keys that are not stored in AWS (e.g., due to a mandate that keys must be kept on-premises) and the company had a separate mechanism to rotate keys and audit usage, such as a custom solution using AWS CloudTrail and Secrets Manager.
Why candidates choose this
Candidates may think that storing keys in Secrets Manager with automatic rotation satisfies the key rotation requirement, and they may overlook that SSE-C does not support automatic rotation or provide the detailed audit trail needed.
✗Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.Wrong answer — click to see why▾
Why this is wrong here
AWS CloudHSM does not provide automatic key rotation; the Lambda function would need to be custom-built and managed, and CloudHSM does not natively integrate with S3 for encryption, requiring additional complexity. Moreover, CloudHSM lacks a detailed audit trail of key usage by AWS principal without additional logging setup.
★ When this WOULD be the correct answer
A scenario where the compliance policy requires the encryption keys to be stored in a hardware security module (HSM) under the company's direct control, and the company is willing to build custom rotation and logging mechanisms. For example, a company that must meet FIPS 140-2 Level 3 validation and has a dedicated team to manage key lifecycle and audit logging.
Why candidates choose this
Candidates may think CloudHSM provides full control over keys and can be combined with Lambda for rotation, overlooking that AWS KMS with customer managed keys already offers automatic rotation and integrated audit trails via CloudTrail, making it simpler and more aligned with the requirements.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.