CLF-C02 Security and Compliance Practice Question
A company has a security policy that requires all Amazon EBS volumes attached to production Amazon EC2 instances to be encrypted at rest using customer-managed encryption keys. The policy also mandates that the encryption keys must be automatically rotated every 365 days. The company wants to minimize operational overhead by using a managed AWS service for key management and automatic rotation. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Candidates often confuse AWS CloudHSM with KMS, thinking CloudHSM also provides automatic rotation, but CloudHSM requires manual rotation and does not natively integrate with EBS encryption policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (AWS KMS)
AWS KMS is the correct choice because it provides managed customer master keys (CMKs) that can be used to encrypt EBS volumes at rest, and it supports automatic annual key rotation (every 365 days) with no additional operational overhead. KMS integrates directly with EBS to enforce encryption using customer-managed keys, meeting both the encryption and rotation requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM provides dedicated hardware security modules (HSMs) for key storage, but it does not offer built-in automatic key rotation. Customers must build and manage their own rotation scripts, increasing operational overhead. It is not a fully managed key rotation service.
When this WOULD be correct
A company must meet regulatory compliance that requires dedicated, single-tenant HSM hardware for key storage, and they are willing to manage key rotation manually or via custom automation. In such a scenario, AWS CloudHSM would be the correct choice.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager (ACM) is a service for provisioning, managing, and deploying public and private SSL/TLS certificates, primarily used to secure network traffic over HTTPS and other TLS-based protocols. It does not create, store, or rotate symmetric data keys or customer master keys used for Amazon EBS encryption; EBS encryption relies on AWS KMS keys, not on certificate infrastructure. ACM's automatic renewal applies to issued certificates, not to encryption keys, so it cannot satisfy a policy requiring automatic rotation of EBS encryption keys. Even if ACM were integrated, it lacks the IAM policy and grant mechanisms that EBS uses to authorize encryption and decryption operations.
When this WOULD be correct
A company needs to automatically renew SSL/TLS certificates for a web application hosted on EC2 instances behind an Application Load Balancer, and wants to minimize manual intervention. ACM would be the correct service to provision and automatically renew these certificates.
- ✓
AWS Key Management Service (AWS KMS)
Why this is correct
AWS KMS is a fully managed service that enables you to create, control, and rotate customer-managed keys. It supports automatic annual key rotation for customer managed keys with a simple checkbox, and integrates seamlessly with Amazon EBS for encryption at rest, meeting the policy requirements with minimal overhead.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is designed to securely store, rotate, and manage secrets such as database credentials, API keys, and other sensitive information. It is not intended for managing encryption keys for EBS volumes, and it does not integrate with EBS encryption.
When this WOULD be correct
A company needs to automatically rotate secrets (e.g., database passwords, API tokens) every 90 days and securely store them. AWS Secrets Manager would be the correct service to meet that requirement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Key Management Service (AWS KMS)Correct answer▾
Why this is correct
AWS KMS is a fully managed service that enables you to create, control, and rotate customer-managed keys. It supports automatic annual key rotation for customer managed keys with a simple checkbox, and integrates seamlessly with Amazon EBS for encryption at rest, meeting the policy requirements with minimal overhead.
✗AWS CloudHSMWrong answer — click to see why▾
Why this is wrong here
AWS CloudHSM provides hardware security modules (HSMs) but does not offer automatic key rotation; it requires manual rotation or custom scripting, increasing operational overhead. The question specifies automatic rotation every 365 days, which is a built-in feature of AWS KMS, not CloudHSM.
★ When this WOULD be the correct answer
A company must meet regulatory compliance that requires dedicated, single-tenant HSM hardware for key storage, and they are willing to manage key rotation manually or via custom automation. In such a scenario, AWS CloudHSM would be the correct choice.
Why candidates choose this
Candidates may confuse CloudHSM as a more secure option for key management, not realizing that AWS KMS also uses HSMs and provides automatic key rotation with less operational overhead.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates, not for managing encryption keys for EBS volumes. It does not provide customer-managed keys or automatic rotation for EBS encryption.
★ When this WOULD be the correct answer
A company needs to automatically renew SSL/TLS certificates for a web application hosted on EC2 instances behind an Application Load Balancer, and wants to minimize manual intervention. ACM would be the correct service to provision and automatically renew these certificates.
Why candidates choose this
Candidates may confuse 'certificate' with 'encryption key' and think ACM handles key management, especially since both involve encryption and automatic rotation.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys for EBS volumes. It does not provide the key management or automatic rotation for customer-managed encryption keys used with EBS encryption.
★ When this WOULD be the correct answer
A company needs to automatically rotate secrets (e.g., database passwords, API tokens) every 90 days and securely store them. AWS Secrets Manager would be the correct service to meet that requirement.
Why candidates choose this
Candidates may confuse 'secrets' with 'encryption keys' and assume Secrets Manager can handle key rotation, but it is not integrated with EBS encryption and does not manage KMS keys.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.