CLF-C02 Security and Compliance Practice Question
A company encrypts data stored in Amazon S3, Amazon RDS, and Amazon EBS. The security team needs a managed service to create, rotate, and control the encryption keys used to protect this data, with full audit trails of key usage. Which AWS service should they use?
⚠ Common exam trap
A common mix-up: candidates confuse AWS KMS with AWS CloudHSM, mistakenly thinking CloudHSM is required for full control and audit trails, but KMS provides managed key rotation and native CloudTrail integration without the operational overhead of managing HSMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS KMS
AWS KMS is a managed service that allows you to create, rotate, and control encryption keys used to protect data in Amazon S3, Amazon RDS, and Amazon EBS. It integrates with AWS CloudTrail to provide full audit trails of key usage, meeting the security team's requirements for a managed key management solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM is incorrect because it provides dedicated hardware security modules (HSMs) requiring customers to manage the HSM cluster, patching, and high availability, which contradicts the need for a *managed service* for key creation and rotation. While offering high security, it does not provide the integrated key management and automatic audit trails that the scenario demands from a fully managed service. CloudHSM is appropriate for stringent regulatory compliance requiring single-tenant HSMs and direct control over the cryptographic hardware, such as FIPS 140-2 Level 3 validation.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is incorrect because its primary function is to store, rotate, and securely retrieve sensitive secrets such as database passwords, API keys, and OAuth tokens—not to serve as a central encryption key management service. It does use AWS KMS under the hood to encrypt the secret values, but that means it relies on KMS for the actual key management and audit trail. Furthermore, Secrets Manager lacks the deep integration with data services like S3, EBS, and RDS for native envelope encryption that KMS provides, making it unsuitable for the stated key management requirement.
- ✓
AWS KMS
Why this is correct
AWS KMS is the correct choice because it is a fully managed service that creates, stores, and rotates customer master keys (CMKs) used for encrypting data at rest in services like S3, RDS, and EBS. It integrates with CloudTrail to automatically log every key usage and management event, delivering the auditable trail required for compliance. Unlike other options, KMS is purpose-built for encryption key lifecycle management and provides fine-grained access control via key policies and IAM, making it the right fit for the scenario.
- ✗
AWS Certificate Manager
Why it's wrong here
AWS Certificate Manager (ACM) is incorrect because it specializes in provisioning and managing SSL/TLS certificates for encrypting data in transit between clients and servers (e.g., HTTPS termination on load balancers or CloudFront). It does not create or manage encryption keys for data at rest, nor does it provide the key rotation or audit logging for database or storage encryption that the scenario requires. While ACM uses encryption, its scope is limited to public/private certificates, not general-purpose key management like KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.