CLF-C02 Security and Compliance Practice Question
A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?
⚠ Common exam trap
A common mix-up: candidates confuse SSE-S3's automatic key management (which rotates keys but not on a customer-defined schedule) with the automatic rotation and IAM control provided only by SSE-KMS with a customer managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key
SSE-KMS with a customer managed key is correct because it allows automatic key rotation every 12 months (configurable via the AWS KMS console) and enables fine-grained access control through IAM policies and key policies. This meets both the regulatory rotation requirement and the security team's need to control decryption of specific S3 objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C requires the customer to supply and manage the encryption keys. The customer must provide the key with each request, and AWS does not manage key rotation. This does not meet the automatic rotation requirement.
When this WOULD be correct
A company must use its own encryption keys and maintain full control over key management, including rotation, and does not require AWS to manage the keys. The regulation mandates customer-managed key rotation, and the company has its own key management infrastructure.
- ✓
Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key
Why this is correct
SSE-KMS with a customer managed key allows the company to define IAM and key policies for granular access control. AWS KMS can automatically rotate the key annually (configurable), satisfying the regulation. This is the correct solution.
- ✗
Client-side encryption using the AWS Encryption SDK
Why it's wrong here
Client-side encryption requires the application to encrypt data before uploading it to S3. The customer is responsible for key management and rotation; AWS does not perform automatic rotation. This adds complexity and does not meet the automatic rotation requirement.
When this WOULD be correct
A company needs to encrypt sensitive data before sending it to S3 and wants to maintain full control over the encryption process and keys, without relying on AWS for key management. The regulation does not require automatic key rotation or IAM-based access control for decryption.
- ✗
Server-side encryption with Amazon S3 managed keys (SSE-S3)
Why it's wrong here
SSE-S3 uses managed keys that are automatically rotated by AWS, but it does not allow the customer to control access to the keys with IAM policies. The company cannot restrict decryption to specific users or roles, which violates the access control requirement.
When this WOULD be correct
A company needs to encrypt S3 objects at rest with minimal configuration and no requirement for customer-managed key rotation or granular access control. For example, a media company storing non-sensitive public content where default encryption is sufficient.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed keyCorrect answer▾
Why this is correct
SSE-KMS with a customer managed key allows the company to define IAM and key policies for granular access control. AWS KMS can automatically rotate the key annually (configurable), satisfying the regulation. This is the correct solution.
✗Server-side encryption with customer-provided keys (SSE-C)Wrong answer — click to see why▾
Why this is wrong here
SSE-C requires the customer to manage and rotate their own encryption keys, which does not satisfy the requirement for automatic key rotation every 12 months. AWS does not rotate SSE-C keys automatically.
★ When this WOULD be the correct answer
A company must use its own encryption keys and maintain full control over key management, including rotation, and does not require AWS to manage the keys. The regulation mandates customer-managed key rotation, and the company has its own key management infrastructure.
Why candidates choose this
Candidates may think SSE-C provides more control over keys, but they overlook the automatic rotation requirement and the need for IAM-based access control, which SSE-C does not support.
✗Client-side encryption using the AWS Encryption SDKWrong answer — click to see why▾
Why this is wrong here
Client-side encryption does not allow the security team to use IAM policies to control decryption of specific S3 objects, as decryption happens outside AWS. The regulation requires automatic key rotation every 12 months, which client-side encryption does not natively support.
★ When this WOULD be the correct answer
A company needs to encrypt sensitive data before sending it to S3 and wants to maintain full control over the encryption process and keys, without relying on AWS for key management. The regulation does not require automatic key rotation or IAM-based access control for decryption.
Why candidates choose this
Candidates may think client-side encryption offers more control over keys and decryption, but they overlook that IAM policies cannot govern decryption on the client side and that key rotation must be manually implemented.
✗Server-side encryption with Amazon S3 managed keys (SSE-S3)Wrong answer — click to see why▾
Why this is wrong here
SSE-S3 does not support automatic key rotation every 12 months; it uses S3-managed keys with no customer control over rotation schedule. Additionally, SSE-S3 does not allow using IAM policies to control decryption of specific objects.
★ When this WOULD be the correct answer
A company needs to encrypt S3 objects at rest with minimal configuration and no requirement for customer-managed key rotation or granular access control. For example, a media company storing non-sensitive public content where default encryption is sufficient.
Why candidates choose this
Candidates may assume SSE-S3 is simpler and still compliant, but they overlook the specific requirements for automatic key rotation and IAM-based decryption control that only SSE-KMS with customer managed keys can satisfy.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.