ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Study guide / Encryption

Encryption: CLF-C02 study notes and practice questions

What to know about Encryption for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 2 free questions to test it. Part of the CLF-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

Encryption questions at this level ask which service manages keys or certificates, and whether data is protected at rest or in transit.

At rest and in transit

  • Encryption at rest protects stored data: S3 objects, EBS volumes, RDS databases, DynamoDB tables.
  • Encryption in transit protects data moving over a network, usually with TLS (HTTPS).

The services

Service Job
AWS Key Management Service (KMS) Create, control and audit encryption keys used by most AWS services. Key use is logged in CloudTrail
AWS CloudHSM Dedicated hardware security modules that only you control, for strict regulatory needs
AWS Certificate Manager (ACM) Issue and renew TLS certificates for load balancers, CloudFront and API Gateway; public certificates have no extra charge
AWS Secrets Manager Store and rotate credentials such as database passwords

Key facts

  • Amazon S3 encrypts all new objects by default (since January 2023) with S3-managed keys, at no extra cost.
  • AWS managed keys are created for you by services; customer managed keys in KMS let you set your own key policy, which controls who can use the key.
  • Client-side encryption means you encrypt data before sending it to AWS, so AWS never sees it unencrypted.
  • Encryption is a customer responsibility in the shared responsibility model: AWS provides the tools, you decide what to encrypt and how.

How to choose

  • “Manage encryption keys with an audit trail”: KMS.
  • “Single-tenant hardware for keys to meet a regulation”: CloudHSM.
  • “HTTPS certificate for a website on a load balancer”: ACM.
  • “Rotate database passwords automatically”: Secrets Manager.

Common traps

  • KMS vs CloudHSM. KMS is the default answer; CloudHSM only when dedicated hardware is required.
  • ACM for data at rest. ACM certificates protect data in transit.
  • Thinking encryption is AWS’s responsibility. Customers choose and configure it.

Try the 2 practice questions

Practice EncryptionTake the free practice exam

Question 1

Easier ·Link to this question (question 1)

A healthcare company stores patient scans in Amazon S3.

It wants to create its own encryption keys, write a key policy that limits which roles can use each key, and keep the key material in FIPS-validated hardware security modules.

Which AWS service should it use?

Choose one answer.

  1. A. AWS Certificate Manager (ACM), which issues and renews SSL/TLS certificates
  2. B. AWS Key Management Service (AWS KMS), which creates keys and controls who can use them
  3. C. AWS Secrets Manager, which stores and rotates database passwords and API keys
  4. D. Amazon Macie, which discovers sensitive data such as PII in Amazon S3
Show the answer and explanation

Answer: B

  • A. Wrong: ACM manages certificates for encrypting data in transit. It does not create the keys that protect data stored in S3, so it misses the requirement.
  • B. Right: Correct. AWS KMS creates and manages encryption keys, uses key policies to control who can use each key, and protects key material in FIPS 140-3 Level 3 validated hardware security modules. S3 can encrypt objects with these keys through SSE-KMS. Learn more: AWS Key Management Service (opens in a new tab)
  • C. Wrong: Secrets Manager stores and rotates secrets such as passwords. It is not the service for creating and controlling encryption keys, so it does not fit.
  • D. Wrong: Macie finds sensitive data in S3 by inspecting it. It does not create or manage encryption keys.

Explanation

AWS KMS is the service for creating and controlling encryption keys. With customer managed keys, the company writes the key policy that decides which roles can use each key, and KMS keeps the key material in FIPS-validated hardware security modules. ACM, Secrets Manager and Macie each do a different job, so none of them meets the requirement.

Study

Question 2

Medium ·Link to this question (question 2)

A developer's upload script writes new objects to an Amazon S3 bucket and sets no encryption options.

The compliance team wants every object encrypted at rest, without changing the script and without adding cost.

Which statement is accurate?

Choose one answer.

  1. A. S3 stores the object unencrypted until the bucket owner separately turns on default encryption
  2. B. S3 rejects the upload, because a request that does not name an AWS KMS key is always refused
  3. C. S3 encrypts the object with SSE-S3 by default at no extra charge, so the script is unchanged
  4. D. S3 encrypts the object with SSE-KMS by default, which adds AWS KMS request and key charges to uploads
Show the answer and explanation

Answer: C

  • A. Wrong: Since January 5, 2023, S3 encrypts all new uploads automatically, so no bucket setting is needed for new objects to be encrypted.
  • B. Wrong: Uploads do not need to name a key. With no encryption options, S3 applies its default encryption, so the upload succeeds.
  • C. Right: Correct. All new S3 uploads are encrypted with SSE-S3 by default, and that encryption has no additional charge. Storage and requests are still billed as usual. Learn more: Default encryption FAQ for Amazon S3 (opens in a new tab)
  • D. Wrong: SSE-KMS is an option the team can choose, but it is not the default. The default for new uploads is SSE-S3, which has no additional charge.

Explanation

Starting January 5, 2023, Amazon S3 encrypts every new object with SSE-S3 by default, at no additional charge and with no change to applications. Teams that need control over the key can choose SSE-KMS for the bucket, which adds AWS KMS charges. Encryption in transit is a separate matter and uses HTTPS.

Study

Want more on Encryption? The 5 full-length practice sets have 10 more Encryption questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Encryption

More Security and Compliance topics