AWS CLF-C02 Encryption Exam
Questions 2026–2027 | KMS,
Cryptographic Keys & Cloud Data
Security Certification Prep
1. A company needs to encrypt data stored in Amazon S3 while retaining
control over the encryption keys. Which AWS service should it primarily
use?
A. AWS Secrets Manager
B. AWS Key Management Service (AWS KMS)
C. AWS Certificate Manager
D. Amazon GuardDuty
Answer: AWS Key Management Service (AWS KMS)
Rationale: AWS KMS provides managed cryptographic keys and integrates with
services such as Amazon S3, EBS, RDS, and many other AWS services for
encryption and decryption operations.
, 2. Which AWS KMS key type is designed to provide customers with the
greatest control over the underlying key material?
A. AWS owned key
B. AWS managed key
C. Customer managed key
D. Temporary session key
Answer: Customer managed key
Rationale: Customer managed KMS keys are created, managed, and controlled
by the customer, including policies, grants, rotation configuration, and deletion
scheduling.
3. A company wants AWS to manage the encryption key with minimal
administrative effort when using an AWS service. Which key category is
most appropriate?
A. Customer managed key
B. AWS managed key
C. External key stored in an HSM
D. Asymmetric customer key
Answer: AWS managed key
Rationale: AWS managed keys are created and managed by AWS for supported
AWS services, reducing the customer's key-management responsibilities.
4. Which statement best describes envelope encryption?
A. Encrypting the same plaintext multiple times with different passwords
B. Encrypting data with a data key and encrypting that data key with another key
C. Encrypting only metadata associated with a file
D. Encrypting a KMS key with a TLS certificate
,Answer: Encrypting data with a data key and encrypting that data key with
another key
Rationale: Envelope encryption uses a data key to encrypt the actual data and a
KMS key to protect the data key, improving scalability for large datasets.
5. Which AWS service is primarily responsible for creating and controlling
managed cryptographic keys?
A. AWS KMS
B. AWS IAM
C. Amazon Inspector
D. AWS CloudTrail
Answer: AWS KMS
Rationale: AWS KMS is the AWS managed service specifically designed for
creating, controlling, and using cryptographic keys.
6. A developer needs to encrypt a large file before storing it in Amazon S3.
Why is envelope encryption advantageous?
A. It eliminates the need for encryption
B. It allows the entire file to be encrypted directly by the KMS key
C. It allows efficient data encryption using a data key while KMS protects the data
key
D. It requires no key management
Answer: It allows efficient data encryption using a data key while KMS protects
the data key
Rationale: KMS operations are intended primarily for protecting cryptographic
keys and performing cryptographic operations, while data keys can efficiently
encrypt large amounts of data locally.
, 7. Which AWS KMS operation can generate a data key for client-side
encryption?
A. GenerateDataKey
B. EncryptBucket
C. CreateSessionKey
D. GenerateS3Key
Answer: GenerateDataKey
Rationale: GenerateDataKey generates a plaintext data key and an encrypted
version of that data key protected by the specified KMS key.
8. A company wants to prevent unauthorized IAM principals from using a KMS
key. Which mechanism directly controls access to the KMS key?
A. KMS key policy
B. Amazon Route 53 record
C. Security group
D. Network ACL
Answer: KMS key policy
Rationale: A KMS key policy is the primary resource-based policy mechanism for
controlling access to a KMS key. IAM policies can also participate when
permitted by the key policy.
9. What is the primary purpose of a KMS key policy?
A. Configure DNS resolution
B. Define permissions for using and managing a KMS key
Questions 2026–2027 | KMS,
Cryptographic Keys & Cloud Data
Security Certification Prep
1. A company needs to encrypt data stored in Amazon S3 while retaining
control over the encryption keys. Which AWS service should it primarily
use?
A. AWS Secrets Manager
B. AWS Key Management Service (AWS KMS)
C. AWS Certificate Manager
D. Amazon GuardDuty
Answer: AWS Key Management Service (AWS KMS)
Rationale: AWS KMS provides managed cryptographic keys and integrates with
services such as Amazon S3, EBS, RDS, and many other AWS services for
encryption and decryption operations.
, 2. Which AWS KMS key type is designed to provide customers with the
greatest control over the underlying key material?
A. AWS owned key
B. AWS managed key
C. Customer managed key
D. Temporary session key
Answer: Customer managed key
Rationale: Customer managed KMS keys are created, managed, and controlled
by the customer, including policies, grants, rotation configuration, and deletion
scheduling.
3. A company wants AWS to manage the encryption key with minimal
administrative effort when using an AWS service. Which key category is
most appropriate?
A. Customer managed key
B. AWS managed key
C. External key stored in an HSM
D. Asymmetric customer key
Answer: AWS managed key
Rationale: AWS managed keys are created and managed by AWS for supported
AWS services, reducing the customer's key-management responsibilities.
4. Which statement best describes envelope encryption?
A. Encrypting the same plaintext multiple times with different passwords
B. Encrypting data with a data key and encrypting that data key with another key
C. Encrypting only metadata associated with a file
D. Encrypting a KMS key with a TLS certificate
,Answer: Encrypting data with a data key and encrypting that data key with
another key
Rationale: Envelope encryption uses a data key to encrypt the actual data and a
KMS key to protect the data key, improving scalability for large datasets.
5. Which AWS service is primarily responsible for creating and controlling
managed cryptographic keys?
A. AWS KMS
B. AWS IAM
C. Amazon Inspector
D. AWS CloudTrail
Answer: AWS KMS
Rationale: AWS KMS is the AWS managed service specifically designed for
creating, controlling, and using cryptographic keys.
6. A developer needs to encrypt a large file before storing it in Amazon S3.
Why is envelope encryption advantageous?
A. It eliminates the need for encryption
B. It allows the entire file to be encrypted directly by the KMS key
C. It allows efficient data encryption using a data key while KMS protects the data
key
D. It requires no key management
Answer: It allows efficient data encryption using a data key while KMS protects
the data key
Rationale: KMS operations are intended primarily for protecting cryptographic
keys and performing cryptographic operations, while data keys can efficiently
encrypt large amounts of data locally.
, 7. Which AWS KMS operation can generate a data key for client-side
encryption?
A. GenerateDataKey
B. EncryptBucket
C. CreateSessionKey
D. GenerateS3Key
Answer: GenerateDataKey
Rationale: GenerateDataKey generates a plaintext data key and an encrypted
version of that data key protected by the specified KMS key.
8. A company wants to prevent unauthorized IAM principals from using a KMS
key. Which mechanism directly controls access to the KMS key?
A. KMS key policy
B. Amazon Route 53 record
C. Security group
D. Network ACL
Answer: KMS key policy
Rationale: A KMS key policy is the primary resource-based policy mechanism for
controlling access to a KMS key. IAM policies can also participate when
permitted by the key policy.
9. What is the primary purpose of a KMS key policy?
A. Configure DNS resolution
B. Define permissions for using and managing a KMS key
