SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS KMS instead of CloudHSM for better durability

  Why it's wrong here

  KMS is a managed service that provides durable, multi-AZ key storage, but CloudHSM is not inherently less durable; it can achieve the same availability by deploying a cluster across Availability Zones. The real benefit of CloudHSM is single-tenant hardware with FIPS 140-2 Level 3 validation, allowing you to control the HSM and manage keys via PKCS#11, JCE, or OpenSSL APIs. Choosing KMS would change your key-management architecture and reduce your direct control over the underlying HSM, not improve durability. Therefore, 'use KMS for better durability' is not a valid option.

• ✗

  Deploy a single CloudHSM instance in one Availability Zone

  Why it's wrong here

  A single HSM instance deployed in one Availability Zone creates a single point of failure because CloudHSM hardware must be available for cryptographic operations, and a power outage, network partition, or device failure in that AZ makes the HSM unreachable. Cluster clients would fail to connect, and while the keys still exist on the device, they are not automatically copied to any other HSM. AWS recommends a minimum of two HSMs in different Availability Zones so the cluster can fail over transparently; one HSM gives no redundancy. Thus, this does not meet high-availability requirements.

• ✗

  Deploy CloudHSM in two AWS Regions with automatic replication

  Why it's wrong here

  Deploying CloudHSM in two AWS Regions cannot rely on automatic cross-region replication because CloudHSM cluster synchronization only replicates data among HSMs in the same cluster and same Region. To move keys between Regions, you must create an HSM backup in the source Region and restore it into a cluster in the target Region, using the CloudHSM CLI or console; this is a manual backup/restore process, not automatic replication. Additionally, a single HSM in each Region would still lack high availability within each region. Therefore, the step is incorrect because automatic cross-region replication is not a CloudHSM feature.

• ✓

  Deploy a CloudHSM cluster with at least two HSMs in different Availability Zones

  Why this is correct

  Creating a CloudHSM cluster with at least two HSMs in different Availability Zones ensures that if one HSM or AZ becomes unavailable, the other HSM can continue serving cryptographic operations. CloudHSM automatically synchronizes users, keys, and policies across all HSMs in the cluster, so the remaining HSM has the same key material. This architecture provides redundancy, high availability, and aligns with AWS recommended best practices for CloudHSM. Hence, it is the correct answer for improving durability/availability while keeping the HSM-based control.

Go deeper

Related to this question