A compliance requirement mandates dedicated, single-tenant FIPS 140-2 Level 3 HSMs where YOUR team controls the keys and AWS cannot access them. Which service meets this?
A.AWS KMS with customer-managed keys
KMS is multi-tenant — fails the single-tenant requirement.
B.AWS CloudHSM
Correct. Single-tenant, customer-controlled, FIPS 140-2 L3.
C.AWS Secrets Manager
Secrets storage, not an HSM.
D.KMS with imported key material
Imported keys still run on multi-tenant KMS HSMs.
Why this answer
CloudHSM is the dedicated single-tenant HSM service — you manage the keys, AWS has no access, FIPS 140-2 Level 3. KMS is multi-tenant (AWS-operated) even with CMKs; imported key material still lives in KMS's shared infrastructure.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Encryption & Key Management practice session.
Practice Encryption & Key Management