These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-046
Which AWS service is used to create and manage encryption keys for data at rest?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. AWS Key Management Service
Explanation
AWS Key Management Service is a managed service that creates and manages encryption keys and can be used to encrypt data in services such as S3, EBS, RDS, and DynamoDB.
Per-choice explanations
A. AWS Budgets
Budgets is a service for budget management and cost notifications.
B. Amazon CloudFront
CloudFront is a CDN service.
C. AWS Key Management Service
Correct. KMS is used to create and manage encryption keys.
D. Amazon Route 53
Route 53 is a DNS service.
Practical Use
AWS Key Management Service (AWS KMS) is a managed service that creates and manages encryption keys (Customer Master Keys, CMKs, now called KMS keys) and lets you use them to encrypt data in various AWS services. KMS keys are stored in Hardware Security Modules (HSMs) and are designed never to leave the hardware in plaintext. From major services such as Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Secrets Manager, and AWS Systems Manager Parameter Store, you can specify a KMS key to encrypt data at rest. On the exam, AWS KMS is the expected answer for the prompt asking which service is used to create and manage encryption keys for data at rest. Common distractors include services unrelated to encryption, such as Amazon Route 53 (DNS), Amazon CloudFront (CDN), and AWS Budgets (budget management). When the keyword "create and manage encryption keys" is explicit, a distinction from AWS CloudHSM (use of a dedicated HSM) may sometimes be needed, but at the CLF-C02 level the simple separation of "managed shared HSM equals KMS" and "dedicated single-tenant HSM equals CloudHSM" is enough. In practice, KMS keys come in two types: AWS managed keys (per-service keys managed on the AWS side) and customer managed keys (keys created and managed by the user). Operational tasks include enabling key rotation, controlling key use permissions through IAM policies and KMS key policies, and recording key usage logs for auditing with AWS CloudTrail. CLF-C02 frequently asks about the principle in the shared responsibility model that "data encryption is the user's responsibility" and the point that KMS is at the center of encryption at rest. The division of role with AWS Certificate Manager (ACM), which is used for encryption in transit, should also be understood.