CLF-C02 - Security and Compliance - Section 2.3

Identify AWS encryption options for protecting data, distinguishing encryption in transit from encryption at rest and the role of AWS Key Management Service.

Distinguish encryption in transit, which protects data moving between systems, from encryption at rest, which protects stored data, and identify use cases for each. Recognise AWS Key Management Service as the centralised service for creating and controlling the encryption keys used across AWS services.

Encryption in transitEncryption at restAWS Key Management ServiceData protection

Practice question for this objective

Free sampleSecurity and Compliancemedium

A security team must create cryptographic keys, control which IAM identities may use them, and have AWS handle the secure storage of the key material across several services. Which AWS service is purpose-built to manage these encryption keys centrally?

  • AAmazon GuardDuty, which continuously analyses account logs with threat intelligence to detect suspicious or malicious activity early.
  • BAWS Identity and Access Management, which signs in users and groups and grants permissions to call the various AWS service actions.
  • CAWS Key Management Service, which creates and stores keys and controls which identities are allowed to use them for encryption. Correct
  • DAmazon Macie, which discovers and classifies sensitive data held in Amazon S3 buckets so owners know where it lives.
AWS Key Management Service is the managed service for creating, storing, and controlling access to cryptographic keys used to encrypt data. AWS KMS centralises key management by generating and securely holding key material, enforcing access through policies and IAM, and plugging into services such as Amazon S3 and Amazon EBS so the customer never handles raw keys directly.

Why A is wrong: GuardDuty is a threat-detection service that watches for malicious behaviour, so it monitors activity rather than creating or storing encryption keys.

Why B is wrong: IAM controls who can call AWS actions and is tempting because it manages access, but it does not create or store the cryptographic keys themselves.

Why C is correct: AWS KMS is the managed service for creating, storing, and governing access to cryptographic keys, and it integrates with many AWS services for encryption.

Why D is wrong: Macie finds and labels sensitive data such as personal records in S3, so it reports on data exposure rather than managing encryption keys.

See more CLF-C02 practice questions, answers explained.

More in this domain

Back to all Security and Compliance objectives, or the CLF-C02 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.