CLF-C02 Security and Compliance Practice Question
A financial services company must comply with PCI DSS requirements that mandate the use of a dedicated hardware security module (HSM) to store encryption keys used to protect cardholder data. The company plans to use server-side encryption in Amazon S3 and needs to ensure that the encryption keys are stored in a dedicated HSM under the company's sole control. Which AWS service should the company use to meet this requirement?
⚠ Common exam trap
Watch out — candidates often confuse AWS KMS with a dedicated HSM solution, but KMS is a shared, multi-tenant service that does not provide the sole control required by PCI DSS for dedicated HSMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudHSM
AWS CloudHSM provides dedicated hardware security modules (HSMs) that are under the customer's sole control, meeting PCI DSS requirements for storing encryption keys in a dedicated HSM. It allows you to generate and manage your own encryption keys within a single-tenant, FIPS 140-2 Level 3 validated device, ensuring compliance with the mandate for dedicated hardware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS KMS with automatic key rotation
Why it's wrong here
AWS KMS is a fully managed key service backed by FIPS 140-2 validated HSMs, but those HSMs are shared, multi-tenant infrastructure operated by AWS. While the customer controls IAM permissions and can enable automatic key rotation to generate new backing key material, this does not provide exclusive control of a dedicated HSM device. The PCI DSS requirement for a dedicated HSM under sole control is therefore not met by KMS alone, regardless of automatic key rotation.
When this WOULD be correct
A company needs to encrypt S3 objects using server-side encryption with AWS KMS-managed keys (SSE-KMS) and must comply with a policy requiring automatic key rotation every 90 days. AWS KMS with automatic key rotation would be the correct choice.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager (ACM) simplifies provisioning and lifecycle management of SSL/TLS certificates for network services such as Elastic Load Balancing, CloudFront, and API Gateway. ACM does not store or expose the private keys used for S3 server-side encryption, and customers cannot access or control the underlying HSM that protects certificate private keys. Because the PCI DSS requirement in question targets dedicated, customer-controlled HSMs for cardholder-data encryption keys, ACM does not satisfy that control or hardware-storage requirement.
When this WOULD be correct
ACM would be correct if the question asked for a service to manage SSL/TLS certificates for securing website traffic (HTTPS) or for use with AWS services like CloudFront or Elastic Load Balancing, without requiring dedicated HSM or customer-controlled keys.
- ✓
AWS CloudHSM
Why this is correct
CloudHSM provides a dedicated HSM appliance that runs in the customer's VPC. The customer has exclusive control over the HSM and the keys it contains, meeting the PCI DSS requirement for a dedicated HSM under sole control.
- ✗
AWS Secrets Manager
Why it's wrong here
AWS Secrets Manager is designed for securely storing and managing secrets such as database credentials, API keys, and other sensitive strings, but it is not an HSM and does not provide hardware-based key storage. Secrets Manager encrypts secret values using a KMS customer master key, meaning the cryptographic operations still rely on AWS-managed, multi-tenant KMS HSMs rather than a customer-controlled dedicated HSM. For S3 server-side encryption, Secrets Manager is not a key management or key-storage service, so it fails the PCI DSS requirement for dedicated HSM control.
When this WOULD be correct
A company needs to securely store and automatically rotate database credentials or API keys, and must centrally audit access to these secrets. AWS Secrets Manager would be the correct choice for managing such secrets with built-in rotation and fine-grained access control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS CloudHSMCorrect answer▾
Why this is correct
CloudHSM provides a dedicated HSM appliance that runs in the customer's VPC. The customer has exclusive control over the HSM and the keys it contains, meeting the PCI DSS requirement for a dedicated HSM under sole control.
✗AWS KMS with automatic key rotationWrong answer — click to see why▾
Why this is wrong here
AWS KMS does not provide a dedicated HSM under the customer's sole control; it is a multi-tenant service where AWS manages the HSM infrastructure. PCI DSS requires a dedicated HSM for which the customer has exclusive control over the encryption keys.
★ When this WOULD be the correct answer
A company needs to encrypt S3 objects using server-side encryption with AWS KMS-managed keys (SSE-KMS) and must comply with a policy requiring automatic key rotation every 90 days. AWS KMS with automatic key rotation would be the correct choice.
Why candidates choose this
Candidates may confuse AWS KMS's HSM-backed key storage (which uses shared HSMs) with a dedicated HSM, or assume that automatic key rotation satisfies PCI DSS requirements without understanding the need for sole control over the HSM.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) manages SSL/TLS certificates, not encryption keys for server-side encryption in S3. It does not provide a dedicated HSM under the customer's sole control, nor does it meet PCI DSS HSM requirements for key storage.
★ When this WOULD be the correct answer
ACM would be correct if the question asked for a service to manage SSL/TLS certificates for securing website traffic (HTTPS) or for use with AWS services like CloudFront or Elastic Load Balancing, without requiring dedicated HSM or customer-controlled keys.
Why candidates choose this
Candidates may confuse ACM with key management services because both involve encryption and certificates, leading them to think ACM can handle encryption keys for S3 server-side encryption.
✗AWS Secrets ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Secrets Manager is designed to manage secrets like database credentials and API keys, not to provide dedicated HSM hardware under the customer's sole control. It does not meet PCI DSS requirements for a dedicated HSM for encryption key storage.
★ When this WOULD be the correct answer
A company needs to securely store and automatically rotate database credentials or API keys, and must centrally audit access to these secrets. AWS Secrets Manager would be the correct choice for managing such secrets with built-in rotation and fine-grained access control.
Why candidates choose this
Candidates may confuse Secrets Manager's ability to store encryption keys with the dedicated HSM requirement, or assume that any AWS key management service satisfies PCI DSS HSM mandates without understanding the 'dedicated hardware under sole control' distinction.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.