PAS-C01 Migration Practice Question
A company is migrating SAP applications to AWS and needs to ensure that the migration complies with regulatory requirements for data encryption. Which TWO AWS services can be used to encrypt data at rest? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EBS encryption
Amazon EBS encryption provides at-rest encryption for EBS volumes (Option C). AWS KMS (Key Management Service) manages the encryption keys used by EBS encryption and other AWS services (Option E). Options A and D are incorrect: AWS WAF is a web application firewall, not for data encryption; AWS CloudHSM provides hardware security modules for key storage but is not a direct service for encrypting data at rest. Option B (AWS Certificate Manager) is for SSL/TLS certificates, not data at rest encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF
Why it's wrong here
WAF is a web application firewall.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
ACM is for SSL/TLS certificates, not data at rest encryption.
- ✓
Amazon EBS encryption
Why this is correct
EBS encryption encrypts volumes at rest.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM provides hardware security modules but not typically used for EBS encryption.
- ✓
AWS Key Management Service (KMS)
Why this is correct
KMS manages encryption keys for EBS and other services.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.