A device manufacturer wants to digitally sign their firmware software to generate a digital signature to ensure authenticity. How can this be accomplished in the most cost-efficient way?

Answer options:

A.Use the Sign command in key_mgmt_util in AWS CloudHSM.
B.Use the SignDocument API provided by AWS CloudHSM.
C.Use the Sign API provided by AWS KMS.
D.Use the RequestDocumentSignature API provided by AWS Certificate Manager.

Answer: C
Option A is incorrect because CloudHSM is not a cost-efficient option.
Option B is incorrect because there is no SignDocument CloudHSM API and CloudHSM is not as cost-efficient as KMS.
Option C is CORRECT because KMS has the Sign API that creates a digital signature for a message or message digest using the private key in an asymmetric CMK.
Option D is incorrect because there is no RequestDocumentSignature API in AWS Certificate Manager. AWS Certificate Manager provides functionality relating to the management of SSL Certificates.
Reference:
https://docs.aws.amazon.com/cloudhsm/latest/userguide/introduction.html
https://docs.aws.amazon.com/cloudhsm/latest/userguide/key_mgmt_util-sign.html
https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html