A company wants to have a secure way of generating, storing, and managing cryptographic keys, but they want to have exclusive access to the management of the keys. Which of the following can be used for this purpose?

Answer options:

A.Use KMS and the normal KMS encryption keys.
B.Use KMS and use an external key material.
C.Use S3 Server Side encryption.
D.Use Cloud HSM.

Answer: D
Options A and B are incorrect because, in these cases, the management of the key will be within AWS.
Option C is incorrect because S3 Server Side encryption does not generate or manage cryptographic keys.
Option D is CORRECT because CloudHSM allows you to securely generate, store, and manage cryptographic keys used for data encryption in a way that keys are accessible and managed only by you.
For more information on CloudHSM, please visit the following URL:
https://aws.amazon.com/cloudhsm/faqs/