CLF-C02 Security and Compliance Practice Question
A company is required by their compliance framework to encrypt all data at rest and in transit. Which AWS service provides centralized key creation, management, rotation, and audit logging for encryption keys used across AWS services?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Secrets Manager's secret rotation capability with encryption key management, but Secrets Manager does not create or manage encryption keys—it relies on KMS for that purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is the correct choice because it is a fully managed service that provides centralized control over encryption keys, including creation, rotation, and audit logging via AWS CloudTrail. It integrates seamlessly with other AWS services (e.g., S3, EBS, RDS) to encrypt data at rest and supports TLS/SSL for data in transit, meeting compliance requirements for key lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is a purpose-built service for managing secrets such as database credentials and API keys, with features like automatic rotation and fine-grained access policies. While it integrates with AWS KMS to encrypt the secrets it stores, Secrets Manager itself does not manage the encryption keys — it delegates that to KMS. Therefore, it is not the correct answer for a service focused on cryptographic key management, making it a wrong option.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM offers dedicated, single-tenant hardware security modules (HSMs) that you administer directly, giving you full control over the HSM cluster and the keys it protects. In contrast, AWS KMS is a fully managed service that abstracts the underlying HSMs and provides seamless integration with other AWS services. For the general case of centralized key management with automatic rotation and audit, KMS is the standard service, while CloudHSM is a specialized option, so CloudHSM is not the correct answer.
- ✓
AWS Key Management Service (KMS)
Why this is correct
AWS Key Management Service (KMS) is a fully managed service that centralizes the creation, storage, and lifecycle management of encryption keys. It integrates with AWS CloudTrail to log every key operation, offers fine-grained IAM policies for key usage, and can automatically rotate keys annually. Keys are protected by FIPS-validated HSMs in AWS data centers. These capabilities make KMS the correct answer for a service that provides cryptographic key management with auditability and access control.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie is a data security service that uses machine learning and pattern matching to detect and classify sensitive data, such as personally identifiable information (PII), stored in Amazon S3. It does not manage cryptographic keys; any encryption of findings or data is handled through AWS KMS. Because Macie's role is data discovery and classification rather than key management, it is an incorrect answer to this question.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.