CLF-C02 Security and Compliance Practice Question
A healthcare company is required to encrypt all protected health information (PHI) stored in Amazon S3. The company must maintain control over the encryption keys, rotate them annually, and log all key usage. Which AWS service or feature should they use to meet these requirements?
⚠ Common exam trap
Many candidates confuse SSE-S3 (which is simpler but lacks key control and logging) with the required key management and audit capabilities, or they mistakenly think ACM can be used for S3 encryption when it only handles transport layer security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (AWS KMS) with customer managed keys
AWS KMS with customer managed keys is correct because it allows the healthcare company to maintain full control over the encryption keys, enforce annual rotation (via automatic or manual key rotation), and log all key usage through AWS CloudTrail. This meets the compliance requirements for protecting PHI in S3 while retaining key management authority.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)
Why it's wrong here
SSE-S3 encrypts your data using keys that Amazon manages entirely on your behalf, providing strong default encryption with no additional effort. However, because you never control or rotate the keys yourself, and S3 does not emit per-object key usage events to CloudTrail, you cannot demonstrate the specific technical controls often demanded by regulators. It simply cannot provide the customer-controlled key lifecycle and audibility that the question requires.
When this WOULD be correct
A company needs to encrypt S3 data at rest with minimal management overhead and does not require control over the encryption keys, key rotation, or key usage logging. For example, a non-sensitive data storage requirement where default encryption is sufficient.
- ✓
AWS Key Management Service (AWS KMS) with customer managed keys
Why this is correct
AWS KMS with customer managed keys places the cryptographic key material under your direct control, allowing you to define key policies, set automatic yearly rotation, and grant granular permissions. Each decrypt operation is recorded in AWS CloudTrail, so you can verify exactly when and how the protected health information was accessed. This end-to-end governance and audit trail satisfies both the encryption and logical access control requirements of the healthcare company.
- ✗
Amazon S3 server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
With SSE-C, your application must supply the encryption key with every upload and download request, and AWS discards the key after use rather than storing it. This forces you to manage, rotate, and secure the keys yourself, and CloudTrail does not log the key identifiers or usage events. The resulting operational burden and lack of centralized audit capability make SSE-C impractical for meeting HIPAA-style encryption and logging obligations.
When this WOULD be correct
A company needs to encrypt data in Amazon S3 but must maintain full control over the encryption keys and cannot store them in AWS. The company has its own key management infrastructure and wants to provide the keys with each request, without AWS storing or managing the keys.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager provisions and manages public and private TLS/SSL certificates to secure network communications, not data at rest in Amazon S3. While ACM can help protect the transport of PHI, it has no ability to encrypt S3 objects themselves or to log key usage. Relying on ACM would leave the stored data unencrypted and would not satisfy the stated requirement.
When this WOULD be correct
A company needs to manage SSL/TLS certificates for their web application to enable HTTPS, and they want to automate certificate renewals and deployment on AWS resources like CloudFront or Application Load Balancer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Key Management Service (AWS KMS) with customer managed keysCorrect answer▾
Why this is correct
AWS KMS with customer managed keys places the cryptographic key material under your direct control, allowing you to define key policies, set automatic yearly rotation, and grant granular permissions. Each decrypt operation is recorded in AWS CloudTrail, so you can verify exactly when and how the protected health information was accessed. This end-to-end governance and audit trail satisfies both the encryption and logical access control requirements of the healthcare company.
✗Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3)Wrong answer — click to see why▾
Why this is wrong here
SSE-S3 uses Amazon-managed keys, not customer-managed keys, so the company cannot maintain control over the keys, rotate them annually, or log key usage.
★ When this WOULD be the correct answer
A company needs to encrypt S3 data at rest with minimal management overhead and does not require control over the encryption keys, key rotation, or key usage logging. For example, a non-sensitive data storage requirement where default encryption is sufficient.
Why candidates choose this
Candidates may assume SSE-S3 provides encryption and overlook the specific requirements for key control, rotation, and logging, thinking any server-side encryption meets compliance needs.
✗Amazon S3 server-side encryption with customer-provided keys (SSE-C)Wrong answer — click to see why▾
Why this is wrong here
SSE-C requires the customer to manage the encryption keys themselves, including key rotation and logging, but AWS does not log key usage for SSE-C; the customer must implement their own logging. The question requires AWS to log all key usage, which SSE-C does not provide.
★ When this WOULD be the correct answer
A company needs to encrypt data in Amazon S3 but must maintain full control over the encryption keys and cannot store them in AWS. The company has its own key management infrastructure and wants to provide the keys with each request, without AWS storing or managing the keys.
Why candidates choose this
Candidates may think SSE-C gives them full control over keys and rotation, but they overlook that AWS does not log key usage with SSE-C, and the requirement for logging key usage is explicitly stated in the question.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encrypting data at rest in S3 or managing encryption keys.
★ When this WOULD be the correct answer
A company needs to manage SSL/TLS certificates for their web application to enable HTTPS, and they want to automate certificate renewals and deployment on AWS resources like CloudFront or Application Load Balancer.
Why candidates choose this
Candidates may confuse 'encryption' with 'certificates' and think ACM handles key management for data encryption, or they may misread the requirement as needing to secure data in transit rather than at rest.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which AWS service provides a managed way to create, control, and rotate encryption keys used to protect your data?
medium- A.AWS Certificate Manager
- B.AWS Secrets Manager
- ✓ C.AWS Key Management Service (KMS)
- D.AWS CloudHSM
Why C: AWS Key Management Service (KMS) is the correct answer because it is a fully managed service that allows you to create, control, and rotate encryption keys used to protect your data. KMS integrates with other AWS services to encrypt data at rest and provides centralized key management, including automatic annual rotation for customer-managed keys. It uses hardware security modules (HSMs) to protect key material, but the service itself handles the management and rotation lifecycle.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.