Exams / CLF-C02 / Encryption / Question 1
CLF-C02 practice question: Encryption (1 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company wants to create and control the keys used to encrypt its data in Amazon S3 and Amazon EBS, set policies that say who can use each key, and audit how the keys are used. Which AWS service should it use?
Choose one answer.
- AA. AWS Certificate Manager (ACM)
- BB. AWS Key Management Service (AWS KMS)
- CC. AWS Secrets Manager
- DD. Amazon Macie
Show the answer and explanation
Answer: B
- A. Wrong: ACM issues and manages SSL/TLS certificates for encrypting data in transit. It is not used to manage keys for data at rest in S3 and EBS.
- B. Right: Correct. AWS KMS creates and controls encryption keys, uses key policies to control access, integrates with services such as S3 and EBS, and records key use in CloudTrail.
- C. Wrong: Secrets Manager stores and rotates secrets such as database passwords. It uses KMS keys but is not the service for managing them.
- D. Wrong: Macie discovers sensitive data in S3. It does not create or manage encryption keys.
Explanation
AWS KMS is the central service for creating and managing encryption keys. Keys are protected by validated hardware security modules and never leave the service unencrypted. With customer managed keys you control the key policy and can audit every use of the key in AWS CloudTrail, which is how many companies meet encryption-at-rest requirements.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.