Get Your CertCLF-C02PlayCompete
‹ All CLF-C02 questions

CLF-C02 Practice Question 65: Dedicated Hardware Keys

AWS Certified Cloud Practitioner (CLF-C02) · Test 7 · question 5 of 10

Security & Compliancemedium

A bank's regulator requires that its cryptographic keys be generated and stored in single-tenant hardware security modules (HSMs) dedicated to the bank. The bank must have full control of the keys and manage the HSM users itself. Which AWS service meets these requirements?

Select one answer
Show answer and explanation

Answer:

  • D. AWS CloudHSM

AWS CloudHSM provides single-tenant HSMs in the AWS Cloud. In FIPS mode, clusters are validated at FIPS 140-2 or FIPS 140-3 Level 3. The customer has full control of its keys and algorithms, and can generate, store, import, export and use them. The customer also manages its own HSM users, separately from IAM roles, and its data plane is encrypted end to end and not visible to AWS. The trade-off is more responsibility than with a fully managed service, which is exactly what the regulator is asking for.

Option A is the service AWS recommends when you want managed key creation and control but *don't* need to operate your own HSMs. KMS runs and manages the underlying HSMs for you, so it does not give the bank dedicated HSMs whose users it administers. KMS can use a CloudHSM cluster as a custom key store, but then CloudHSM is what supplies the dedicated hardware. Option B, Secrets Manager, stores and rotates secrets such as database passwords; it does not provide HSMs. Option C, ACM, issues and manages SSL/TLS certificates. It is not a way to control your own key-storage hardware.

Reference: What is AWS CloudHSM?

Practice Test 7 ›

Study guides for CLF-C02

AWS interview questions: scenarios, freshers to experiencedAWS interview questions on EC2, Lambda, S3, databases, VPC and IAM, by level, with four scenarios worked end to end and the facts old answers get wrong.
Free cloud certifications in 2026: which are really freeWhich free cloud certifications are really free in 2026: Oracle's free OCI exams, and the voucher routes for AWS, Microsoft and Google, with prices.
SAA-C03 exam guide: what's on it and how to passSAA-C03 exam guide for 2026: the four domains, 65 questions in 130 minutes, price in USD and INR, the October 2026 guide update and a study plan.
Business Automation Examples: McDonald's to Step FunctionsBusiness automation examples from McDonald's, KFC, Ford and Toyota, the four moves they share, what to automate first, and AWS Step Functions.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
AWS Cloud Practitioner exam (CLF-C02) and how to pass itAWS Cloud Practitioner exam (CLF-C02): 65 questions, a 700 pass mark, four domains, exam price, and a free plan to prepare.
What Is AWS Lambda? Triggers, Concurrency and Cold StartsWhat is AWS Lambda? How functions run, cold starts, triggers vs event source mappings, concurrency, layers, aliases, pricing and the exam traps.
What jobs can you get with AWS Cloud Practitioner?What jobs can you get with AWS Cloud Practitioner (CLF-C02)? The roles it helps with, the ones it won't land on its own, and what to add next.
Which cloud certification is best? AWS vs Azure vs GoogleWhich cloud certification is best for a beginner? AWS Cloud Practitioner, AZ-900 and Google Cloud Digital Leader compared: cost, format and which first.
AWS certification cost in 2026, and free ways to prepareWhat every AWS certification costs in 2026 in USD and INR, retake and reschedule rules, the 50% voucher, and the free official ways to prepare.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is AWS Glue? Data Catalog, Crawlers and ETL JobsWhat is AWS Glue? The Data Catalog, crawlers, ETL jobs and DPUs, workflows, streaming, job bookmarks, Flex and Data Quality, plus the traps AWS exams set.
AWS Edge Locations and CloudFront, ExplainedHow AWS edge locations work: CloudFront POPs, regional edge caches, the request path, edge location vs Region, and the Global Accelerator exam trap.
What Is Amazon EC2? Instances, AMIs, EBS and Auto ScalingAmazon EC2 explained: instances, AMIs, instance types, security groups, EBS, Auto Scaling groups and pricing options, with the traps AWS exams set.
Amazon S3 storage classes and lifecycle rulesHow S3 storage classes, Intelligent-Tiering and lifecycle rules work, with the retrieval fees and minimum durations that AWS exam questions turn on.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
The AWS shared responsibility model explainedWhat AWS secures and what you secure on EC2, RDS, Lambda and S3, how the line moves with each service, and how Cloud Practitioner questions test it.