CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Direct Connect with dedicated link guarantees

  Why it's wrong here

  AWS Direct Connect establishes a private, dedicated physical link from your on-premises network to AWS, providing consistent bandwidth and lower latency than the public internet. However, the data flowing over that link is transmitted in cleartext by default—Direct Connect does not inherently encrypt anything. To satisfy encryption-in-transit requirements, you must layer IPsec (via a Site-to-Site VPN) or application-layer encryption on top of the Direct Connect connection. Thus, while it is a private link, it does not 'guarantee' encryption, making it incorrect for this scenario.

• ✓

  AWS Site-to-Site VPN using IPsec encryption

  Why this is correct

  AWS Site-to-Site VPN is explicitly designed to create an encrypted tunnel between your on-premises gateway and a virtual private gateway (or transit gateway) in AWS. It uses IPsec in tunnel mode to provide confidentiality, integrity, and authenticity for all traffic traversing the public internet. With AES-256 or AES-128 encryption and IKE for key exchange, it ensures that data in transit is fully protected against eavesdropping and tampering. Therefore, this is the correct mechanism for achieving encryption in transit between on-premises and AWS.

• ✗

  Amazon S3 SSE-S3 encryption

  Why it's wrong here

  Amazon S3 SSE-S3 is a server-side encryption feature that encrypts objects at rest using AES-256 when they are written to S3 and decrypts them when read. This protects the stored data, but it does not apply to the data while it is being transmitted over a network. When you upload or download an object, you rely on separate TLS/SSL connections to encrypt that transfer, not SSE-S3. Because the requirement is about encrypting data in transit—not at rest—SSE-S3 cannot be the answer.

• ✗

  AWS KMS key rotation

  Why it's wrong here

  AWS KMS key rotation automatically rotates the backing key for an AWS-managed or customer-managed CMK on an annual basis, which helps reduce the risk of compromised keys over time. But rotation is purely a key-management lifecycle operation—it does not directly encrypt any traffic. While KMS itself is used to create and control encryption keys, the actual transport encryption between on-premises and AWS would require something like IPsec. Consequently, enabling key rotation does not by itself provide encryption in transit.

Go deeper

Related to this question