A payment processor must meet PCI DSS and banking regulations requiring single-tenant cryptographic hardware, exclusive key control, and FIPS 140-2 Level 3 validation. Shared multi-tenant key services are prohibited by auditors. Which dedicated hardware security module design satisfies regulatory compliance?

AWS CloudHSM satisfies the mandate because it provisions dedicated single-tenant appliances in the customer VPC validated to FIPS 140-2 Level 3, preserving exclusive customer control over key generation, storage, backup quorum, and cryptographic operations required by PCI DSS and banking regulators when shared tenancy is prohibited. AWS KMS with customer managed keys and CloudTrail logging is a widely adopted pattern for centralized envelope encryption with auditable key policies, but it protects keys on AWS-managed shared HSM fleets, so it cannot provide dedicated hardware isolation and exclusive custody demanded by the auditors. ACM Private Certificate Authority with FIPS endpoints is a sound managed PKI design for issuing private TLS certificates at scale, but it addresses certificate lifecycle rather than single-tenant hardware custody and customer-controlled general-purpose key management. Secrets Manager with automatic rotation and resource policies is standard for securing database credentials and data keys with least privilege, yet it remains an AWS-managed storage service backed by shared key infrastructure and does not deliver customer-controlled dedicated validated hardware. For the exam, distinguish FIPS-connected managed services from dedicated FIPS-validated single-tenant hardware, since only the latter meets explicit isolation wording. In practice, confirm CloudHSM cluster configuration, client SDK integration, backup and quorum controls, and collect FIPS certificates and attestation reports for auditor review.