These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-012
Which AWS service is most appropriate for encrypting data at rest?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: A. AWS Key Management Service
Explanation
AWS KMS creates and manages encryption keys, and it can be used for encryption with many AWS services such as Amazon S3 and DynamoDB.
Per-choice explanations
A. AWS Key Management Service
Correct. KMS is a key management service.
B. Amazon CloudFront
Incorrect. CloudFront is a CDN.
C. Amazon Route 53
Incorrect. Route 53 is a DNS service.
D. AWS Budgets
Incorrect. AWS Budgets is a cost monitoring service.
Practical Use
AWS Key Management Service (KMS) is the central service for encrypting data at rest on AWS. KMS is a managed service that creates, stores, and rotates encryption keys (customer master keys, also called KMS keys). It can be specified as the key used to encrypt data at the storage layer by many AWS services, including S3, EBS, RDS, DynamoDB, Lambda, CloudWatch Logs, Secrets Manager, SNS, and SQS. The keys themselves are protected by hardware security modules (HSMs) that meet FIPS 140-2 validation, and the design ensures that plaintext keys never leave KMS. Usage patterns in practice fall into two main categories. The first is to enable encryption by default using an AWS managed key (such as aws/s3 or aws/ebs, which AWS creates for each service). Unless there is a specific requirement, this is the first step to encrypt data at rest. The second is to create your own customer managed key (CMK) and use it. This is adopted when you need finer-grained control, such as a key rotation policy, control over which IAM principals can use the key, and account-boundary control through key policies. Services that are easily confused include CloudFront (CDN), Route 53 (DNS), and AWS Budgets (cost monitoring). None of these are responsible for encryption, and recognizing this makes it easier to narrow down the choices. On CLF-C02, this content is asked as a question that requests the service used to encrypt data at rest, or the key management service used to encrypt data stored in S3 or DynamoDB. Distractors that present a CDN, a DNS service, or a cost monitoring service are common. From SAA-C03 onward, the distinction among SSE-S3, SSE-KMS, SSE-C, and client-side encryption, the combination of key policies and IAM policies, and the mechanism of envelope encryption are asked in greater depth.