A defense agency must host a classified workload in a fully isolated environment with no connection to the public internet and infrastructure dedicated to that classification level. Encryption keys must be stored in hardware modules validated to FIPS 140-2 Level 3. Which deployment meets all of these requirements?
Show answer and explanation
Answer: C
A Secret Region is an AWS environment isolated from commercial AWS, built for classified government workloads, and it has no internet connectivity. CloudHSM provides hardware security modules validated to FIPS 140-2 Level 3 for key storage. GovCloud supports sensitive government data but is not the classified, air-gapped option, commercial Regions are shared with the internet, and Outposts depends on a connection to a parent Region.
Why the other options are wrong
- A. GovCloud meets many federal compliance needs, but a VPN to the agency network still relies on a connection path that a classified, air-gapped design excludes.
- B. Commercial Regions are not isolated environments for classified data, and KMS alone does not provide the dedicated, air-gapped infrastructure the requirement describes.
- D. Outposts extends AWS services into a data center, but it depends on a connection to a parent Region, so it cannot meet a no-internet, air-gapped classified requirement.