PAS-C01 Design of SAP Workloads on AWS Practice Question
A company is running SAP HANA on AWS and wants to encrypt the EBS volumes at rest. They also need to manage the encryption keys themselves. Which solution should they use?
⚠ Common exam trap
Many exam-takers confuse CloudHSM as a valid option for EBS encryption because it provides key storage, but AWS EBS encryption only supports KMS keys, not direct CloudHSM integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS KMS with a customer managed key (CMK)
AWS KMS with a customer managed key (CMK) allows the company to have full control over the encryption keys used for EBS volume encryption, including key rotation, access policies, and disabling or deleting the key. This meets the requirement to manage the encryption keys themselves while still leveraging AWS KMS for key management and auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS KMS with a customer managed key (CMK)
Why this is correct
CMK allows customer to manage keys.
- ✗
Enable EBS encryption with the default AWS managed KMS key
Why it's wrong here
Default key is AWS-managed, not customer managed.
- ✗
Use AWS CloudHSM to store keys
Why it's wrong here
CloudHSM is possible but overkill and not directly integrated with EBS encryption.
- ✗
Use AWS Systems Manager Parameter Store
Why it's wrong here
Parameter Store is not for EBS encryption.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.