You need to have a cloud security device which would allow to generate encryption keys based on FIPS 140-2 Level 3. Which of the following can be used for this purpose?

Question

Options

• AAWS KMS
• BAWS Customer Keys
• CAWS managed keys
• DAWS Cloud HSM

• A
  71% (15)
• B
  19% (4)
• C
  10% (2)

Explanation

Both AWS KMS and AWS CloudHSM use FIPS 140-2 validated Hardware Security Modules (HSMs) to generate and protect encryption keys. AWS KMS uses HSMs validated under FIPS 140-2 (with Level 3 physical security controls), while AWS CloudHSM is explicitly validated at FIPS 140-2 Level 3 - giving you dedicated, single-tenant HSM hardware and full control over key material.

Why the distractors are wrong:

• B. AWS Customer Keys - This is not a distinct AWS service; "customer managed keys" (CMKs) are a type of key within KMS, not a security device capable of FIPS-validated key generation on their own.
• C. AWS Managed Keys - Similarly, these are keys that AWS services manage on your behalf inside KMS, not a standalone service or device - they don't independently satisfy FIPS requirements.

Memory tip: Focus on the word device in the question. KMS and CloudHSM are actual services backed by physical HSM hardware - that's the FIPS-validated layer. Customer Keys and Managed Keys are just key types (nouns, not tools). If you see "FIPS 140-2 Level 3 + dedicated hardware + customer control," that's CloudHSM; if you see "FIPS 140-2 + managed service," that's KMS.

No community discussion yet for this question.