How to Create CloudHSM-Backed KMS Keys and Audit Their Use?

Design and implement controls to protect credentials, secrets, and cryptographic key materials. Design and implement controls that provide confidentiality and integrity for data at rest. Design and implement a logging solution.

Answer Correct answer: D — Use AWS KMS custom key stores backed by CloudHSM for the keys and AWS CloudTrail to audit key use.

A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster. The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys. How can the security engineer meet these requirements?

To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail. Correct Answer

Community Insight

The question tests the pairing of a CloudHSM-backed KMS custom key store for key creation and control with CloudTrail for auditing; the trap is selecting a detection or query service such as GuardDuty or Athena for audit evidence.

Creating and controlling keys in AWS KMS custom key stores backed by AWS CloudHSM keeps symmetric key material inside the HSM cluster, and AWS CloudTrail provides the audit trail for key use. This page establishes that option D is correct and explains why Athena, S3, and GuardDuty fail the creation or auditing requirement.

A frequent mistake is choosing GuardDuty for auditing because it is a security service, but GuardDuty finds threats and anomalies rather than recording KMS API calls and key-use events.

Community Discussion (3 comments)

7f6aef3 👍 1 Selected: D

KMS + custom key store con CloudHSM para crear/controlar las claves (simétricas, y data key pairs simétricos/asimétricos para uso local). CloudTrail para auditar el uso de las claves.

gonzales 👍 1 Selected: D

AWS KMS supports custom key stores backed by CloudHSM clusters where: • key material is generated inside the HSM • the keys remain HSM-protected So the key creation must be done with AWS KMS using a custom key store. AWS KMS supports: GenerateDataKey GenerateDataKeyPair GenerateDataKeyPairWithoutPlaintext So applications can locally use: • symmetric data keys • asymmetric key pairs generated by KMS. CloudTrail logs operations such as: Encrypt Decrypt GenerateDataKey GenerateDataKeyPair Sign Verify

bigdata2ml 👍 1 Selected: D

Key Creation - KMS Store - CloudHSM Audit - Cloudtrail

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option D matches both requirements: AWS KMS custom key stores backed by AWS CloudHSM create and control symmetric keys whose material is generated and used inside the HSM cluster, and AWS CloudTrail captures KMS API activity so key use can be audited. KMS supports generating data keys and data key pairs for local application use, while the CloudHSM-backed custom key store keeps the root key material protected. CloudTrail is the native audit trail for KMS key operations, including management and cryptographic usage events delivered to logs. Therefore KMS plus CloudHSM plus CloudTrail is the only combination that covers creation and control, local data key use, and auditing.

Why the Other Options Are Wrong

Option A uses Athena, which is a query service for data in S3 and other sources; it can analyze exported logs but it does not natively record or audit KMS key use. Option B replaces KMS with Amazon S3, but S3 is object storage and cannot create or control KMS keys in a CloudHSM-backed custom key store. Option C uses GuardDuty, which detects threats and anomalous behavior rather than providing the authoritative audit record of KMS API calls and key-use events. None of these alternatives satisfies the requirement to create and control keys with KMS plus CloudHSM while also auditing key use reliably.

Community Comment Notes

As 7f6aef3 summarized, KMS with a CloudHSM custom key store creates and controls the keys, while CloudTrail audits their use. gonzales expands on the CloudHSM property that "key material is generated inside the HSM" and notes the KMS data key APIs that support local application use. bigdata2ml reduces the answer to "Key Creation - KMS Store - CloudHSM Audit - Cloudtrail", reinforcing the separation between key store and audit service. No comment argues for Athena, S3, or GuardDuty.

Official Reference

Exam Strategy

Separate the creation and control plane from the audit plane: KMS custom key stores provide HSM-backed key material, and CloudTrail records key operations. Eliminate options that substitute S3, Athena, or GuardDuty for either role.

Frequently Asked Questions

Why is Amazon GuardDuty wrong for auditing KMS key use here?

GuardDuty detects threats and anomalous behavior; it does not provide the authoritative record of KMS API and key-use events that CloudTrail does.

Why not use Amazon S3 with a CloudHSM custom key store to create keys?

Amazon S3 is object storage and cannot create or control KMS keys; only AWS KMS integrates with a CloudHSM-backed custom key store for that purpose.

More SCS-C03 FAQ →

Related Analysis

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide