SAP-C03 practice question: Certificates, private CA and CloudHSM
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital group runs a legacy record-signing service that signs clinical documents with a private key. The service calls the PKCS#11 interface, so the key must be held in a hardware module that the service can reach directly.
The group's auditors require single-tenant hardware that only the group's own administrators manage, with FIPS 140-3 Level 3 validation. The service runs in two Availability Zones, and the key must survive the loss of one of them.
Which solution meets these requirements?
Choose one answer.
AA. Create an AWS CloudHSM cluster with an HSM in each of two Availability Zones, install the CloudHSM client on the service hosts, and sign through the PKCS#11 library against the cluster.
BB. Create a customer managed KMS asymmetric key in the default key store with an RSA key spec, and have the service call the KMS Sign API for each document instead of using its PKCS#11 interface.
CC. Create the signing key in an AWS KMS custom key store backed by an AWS CloudHSM cluster, and have the service call the KMS Sign API for each document.
DD. Store the signing key in AWS Secrets Manager, encrypted with a customer managed KMS key, and have the service read the key into memory at startup.
Show the answer and explanation
Answer: A
A. Right: Correct. CloudHSM gives dedicated, single-tenant HSMs that the group manages, and the PKCS#11 library lets the service sign with the key that stays inside the module. Two HSMs in separate Availability Zones keep the key available if one zone fails.
B. Wrong: The KMS default key store uses a shared fleet of HSMs managed by AWS, not single-tenant hardware that the group's administrators manage. The service would also have to change from PKCS#11 to the KMS API.
C. Wrong: Custom key stores support only symmetric encryption KMS keys, so they cannot hold an asymmetric signing key. The service would also call the KMS API instead of reaching the HSM through PKCS#11.
D. Wrong: The key would be held in software in the service's memory after startup, which breaks the requirement for a hardware module. Secrets Manager is for secrets, not for hardware-protected signing keys.
Explanation
CloudHSM provides single-tenant, FIPS-validated hardware that the service reaches through PKCS#11, with HSMs in two Availability Zones for resilience. The KMS default key store is shared, custom key stores hold only symmetric keys, and Secrets Manager keeps the key in software.
Want more on Certificates, private CA and CloudHSM? The 5 full-length practice sets have 6 more Certificates, private CA and CloudHSM questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →