PAS-C01 Migration Practice Question
A company is migrating a critical application to AWS and needs to ensure compliance with PCI DSS. The application handles credit card numbers. Which AWS service should be used to encrypt the data at rest?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudHSM
AWS CloudHSM, is correct because it provides dedicated hardware security modules (HSMs) that are FIPS 140-2 Level 3 compliant, which is often required for PCI DSS compliance when handling credit card numbers. Option A (Amazon S3 server-side encryption) is incorrect because it is used for encrypting objects in S3 and does not provide dedicated HSM capabilities. Option B (AWS KMS) is a managed key service but is FIPS 140-2 Level 2 only, which may not meet the stringent requirements of PCI DSS for protecting cardholder data. Option D (AWS Secrets Manager) is incorrect because it manages secrets such as database credentials, not encryption keys for data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 server-side encryption
Why it's wrong here
S3 SSE is for object storage, not for application-level encryption.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
KMS is FIPS 140-2 Level 2, not sufficient for some PCI requirements.
- ✓
AWS CloudHSM
Why this is correct
CloudHSM provides dedicated hardware security modules meeting PCI DSS requirements.
- ✗
AWS Secrets Manager
Why it's wrong here
Secrets Manager manages secrets, not encryption keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.