SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Certificate Manager (ACM)

  Why it's wrong here

  AWS Certificate Manager (ACM) is designed to provision, manage, and renew public and private SSL/TLS certificates used to encrypt data in transit between clients and services such as Elastic Load Balancers, CloudFront, and API Gateway. ACM does not provide any mechanism for encrypting data stored in a database, nor does it integrate with RDS storage-level encryption. While TLS protects data as it moves across a network, it does nothing to protect data at rest in RDS, so ACM is not relevant to this requirement.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  IAM manages authentication and authorisation for user and service access, not data encryption at rest. It lacks any mechanism to encrypt database storage volumes or manage encryption keys. The temptation arises because IAM is often used to control access to encrypted resources, but in this scenario the requirement is for the encryption itself, which IAM cannot perform. For controlling which users can decrypt data, IAM would be correct.

• ✓

  AWS Key Management Service (KMS)

  Why this is correct

  AWS Key Management Service (KMS) is a managed service for creating and controlling customer master keys (CMKs) that encrypt data at rest across AWS services, including Amazon RDS. When you enable encryption on an RDS instance, RDS uses a KMS CMK to encrypt the underlying EBS storage, automated backups, snapshots, and read replicas, with encryption handled transparently by the service. KMS is the only service among these options that natively integrates with RDS for at-rest encryption, making it the correct choice.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs) that you fully control, allowing you to manage your own cryptographic keys inside a tamper-resistant appliance. However, Amazon RDS does not natively integrate with CloudHSM for encryption at rest; RDS encryption uses AWS KMS customer master keys (CMKs) to encrypt data, snapshots, and automated backups. To use CloudHSM with RDS, you would have to implement application-level encryption yourself, which is not the straightforward database-level encryption this scenario requires.

Go deeper

Related to this question