AWS Service for Encrypting Data at Rest
Which AWS service integrates with other AWS services to provide the ability to encrypt data at rest?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of AWS security building blocks and their specific roles; the common trap is confusing KMS's encryption-at-rest function with ACM's TLS certificates, which protect data in transit.
This page explains which AWS service provides encryption at rest by integrating directly with other AWS services. AWS Key Management Service (AWS KMS) is the correct answer, and the analysis clarifies why ACM, IAM, and Security Hub do not perform data-at-rest encryption.
Some learners pick AWS Certificate Manager (ACM), which is the most frequent wrong choice, because it is also a cryptographic service — but ACM issues and manages TLS/SSL certificates for data in transit, not keys that encrypt stored data.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Key Management Service (AWS KMS) is a managed service that creates, stores, and manages cryptographic keys and integrates natively with many AWS services so you can encrypt data at rest with just a few clicks. When you enable encryption on services such as Amazon S3, Amazon EBS, Amazon RDS, and AWS Lambda, KMS provides the customer managed keys or AWS managed keys that perform that encryption. Its defining capability is exactly what the question describes: integrating with other AWS services to encrypt data at rest. All 100 learners voted A, and this aligns with the AWS shared responsibility model, where AWS makes encryption tooling available and customers apply it.Why the Other Options Are Wrong
AWS Certificate Manager (ACM) issues, renews, and deploys SSL/TLS certificates used to encrypt data in transit between clients and endpoints, so it does not encrypt stored data — as one comment succinctly puts it, "KMS = at rest Certificates = in transit." AWS Identity and Access Management (IAM) controls who can call AWS APIs and with what permissions; it manages access, not encryption of data. AWS Security Hub is a security posture management service that aggregates findings and checks compliance standards across accounts, but it neither encrypts data nor issues keys. None of these three services provides the key material and service integrations required for encryption at rest.Community Comment Notes
The community was unanimous, with headinthecloud08 offering the sharpest distinction: "KMS = at rest Certificates = in transit." ShaiTay and another learner both restated AWS KMS as the answer, and no comment contested the key or voted for ACM, IAM, or Security Hub. This consensus happens to match the correct reasoning rather than merely reflecting a majority, so the vote distribution here supports the analysis.Official Reference
Exam Strategy
On the CLF-C02, match security services to their exact purpose: KMS and CloudHMAC-style key services encrypt data at rest, ACM handles TLS certificates for data in transit, IAM handles access, and Security Hub aggregates security findings. Read the trigger phrase in the stem — 'encrypt data at rest' — and pick the key-management service every time.
Frequently Asked Questions
Why is AWS Certificate Manager (ACM) wrong for encrypting data at rest?
ACM issues and renews SSL/TLS certificates, which encrypt data in transit between clients and endpoints. It does not create or manage the keys that encrypt stored data; that is KMS's role.
What is the difference between IAM and KMS in this question?
IAM controls permissions for who can access AWS resources and call APIs. KMS creates and manages cryptographic keys used to encrypt and decrypt data at rest across integrated AWS services.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →