Which AWS Service Manages Encryption Keys in the Cloud?
Which AWS service can a company use to manage encryption keys in the cloud?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
You must distinguish key management (generating, storing, and controlling cryptographic keys) from certificate issuance, license tracking, and directory services — the trap is picking ACM simply because it sounds encryption-related.
This question asks which AWS service a company can use to manage encryption keys in the cloud, and the answer is AWS CloudHSM. The page explains why a dedicated hardware security module satisfies key-management requirements that ACM, License Manager, and Directory Service do not meet.
The most tempting wrong pick is AWS Certificate Manager (ACM), because it deals with certificates and TLS, but ACM provisions and renews certificates rather than giving a company custody of encryption keys. AWS License Manager and AWS Directory Service have nothing to do with cryptographic key management at all.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS CloudHSM is a cloud-based hardware security module (HSM) service that lets you generate, store, and manage your own encryption keys inside dedicated, tamper-resistant hardware in an AWS data center. Because AWS does not have access to the keys stored in your HSM cluster, CloudHSM is the option that most directly matches "manage encryption keys in the cloud" among the choices offered. Community voters agreed unanimously at 100% for C, and ShaiTay simply posted "C. AWS CloudHSM" as the pick. CCNP21 reinforced the concept by recalling the underlying technology, noting "Hardware Security Module...correct".Why the Other Options Are Wrong
AWS Certificate Manager (ACM) handles the lifecycle of SSL/TLS certificates — issuing, renewing, and deploying them — rather than giving customers control of raw encryption keys, so option B is a distractor built on an encryption-adjacent word. AWS License Manager tracks software licenses and usage limits across accounts, and AWS Directory Service provides managed Microsoft Active Directory, neither of which performs cryptographic key custody. In many real designs AWS KMS is the everyday key-management service, but KMS is not listed here, so CloudHSM is the only option that genuinely manages keys. Nikmah captured the reasoning concisely, describing CloudHSM as "Hardware encryption, we manage encryption keys".Community Comment Notes
All three commenters converge on option C, which aligns with the reasoning above. Nikmah's explanation focuses on the customer's ownership of the keys within dedicated hardware, which is the decisive property that distinguishes CloudHSM from ACM. CCNP21's short "Hardware Security Module...correct" highlights the acronym-level fact the exam expects you to recognize. ShaiTay offered the letter only, so the value of that comment is confirmation of consensus rather than additional reasoning.Official Reference
Exam Strategy
When a question says "manage encryption keys," scan the options for the key-custody service (KMS or CloudHSM) and eliminate anything named after certificates, licenses, or directories. Remember that CloudHSM is the option chosen when the requirement is dedicated hardware and customer-controlled keys.
Frequently Asked Questions
Why is AWS Certificate Manager (ACM) not the right answer for managing encryption keys?
ACM issues, renews, and deploys SSL/TLS certificates for your endpoints. It does not give you custody of the underlying encryption keys, which is what the question asks for.
How does CloudHSM differ from AWS KMS for key management?
KMS is a shared, AWS-managed service for creating and controlling keys, while CloudHSM gives you dedicated single-tenant hardware where you own and manage the keys yourself.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →