SCS-C03 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Certificate Manager (ACM) with a public certificate request.

  Why it's wrong here

  ACM public certificates are used for public-facing websites and are issued by Amazon's public CA. While secure, they do not provide a private PKI for internal use and do not give the customer the same level of control over the CA hierarchy or the underlying HSM validation as AWS Private CA.

• ✓

  AWS Private CA.

  Why this is correct

  AWS Private CA is designed specifically for creating private CA hierarchies. It uses managed HSMs that are FIPS 140-2 Level 3 validated to protect the CA's private keys. This service allows you to issue and revoke certificates for internal resources securely while offloading the HSM management to AWS.

• ✗

  AWS CloudHSM with a custom-built OpenSSL CA on EC2.

  Why it's wrong here

  While CloudHSM provides FIPS 140-2 Level 3 HSMs, building a CA on EC2 using OpenSSL is operationally complex and requires manual management of the PKI software, backups, and availability. AWS Private CA is a managed service that provides the same security level with significantly less administrative overhead.

• ✗

  AWS Key Management Service (KMS) with an asymmetric key pair.

  Why it's wrong here

  AWS KMS can store asymmetric keys, but it is not a full-featured Certificate Authority. It does not handle certificate signing requests (CSRs), certificate revocation lists (CRLs), or the certificate lifecycle management required for a PKI. KMS is for general cryptographic operations, whereas AWS Private CA is for issuing certificates.