ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Encryption / Question 1

CLF-C02 practice question: Encryption (1 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A healthcare company stores patient scans in Amazon S3.

It wants to create its own encryption keys, write a key policy that limits which roles can use each key, and keep the key material in FIPS-validated hardware security modules.

Which AWS service should it use?

Choose one answer.

  1. A. AWS Certificate Manager (ACM), which issues and renews SSL/TLS certificates
  2. B. AWS Key Management Service (AWS KMS), which creates keys and controls who can use them
  3. C. AWS Secrets Manager, which stores and rotates database passwords and API keys
  4. D. Amazon Macie, which discovers sensitive data such as PII in Amazon S3
Show the answer and explanation

Answer: B

  • A. Wrong: ACM manages certificates for encrypting data in transit. It does not create the keys that protect data stored in S3, so it misses the requirement.
  • B. Right: Correct. AWS KMS creates and manages encryption keys, uses key policies to control who can use each key, and protects key material in FIPS 140-3 Level 3 validated hardware security modules. S3 can encrypt objects with these keys through SSE-KMS. Learn more: AWS Key Management Service (opens in a new tab)
  • C. Wrong: Secrets Manager stores and rotates secrets such as passwords. It is not the service for creating and controlling encryption keys, so it does not fit.
  • D. Wrong: Macie finds sensitive data in S3 by inspecting it. It does not create or manage encryption keys.

Explanation

AWS KMS is the service for creating and controlling encryption keys. With customer managed keys, the company writes the key policy that decides which roles can use each key, and KMS keeps the key material in FIPS-validated hardware security modules. ACM, Secrets Manager and Macie each do a different job, so none of them meets the requirement.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice EncryptionAll Encryption questions

Want more on Encryption? The 5 full-length practice sets have 10 more Encryption questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets