A company receives call logs as Amazon S3 objects that contain sensitive customer information.

Option C is correct because SSE-KMS encrypts Amazon S3 objects by using AWS KMS keys, and access to those keys can be controlled through IAM policies and KMS key policies so that only specific employees can use them. This directly satisfies both requirements: encryption of the S3 objects and restriction of key usage to a limited group of authorized users. AWS-managed S3 encryption with KMS also requires far less effort than building or operating a dedicated HSM-based solution. This is the standard AWS answer when the question asks for encrypted S3 data with fine-grained control over who can use the encryption keys.

Option A is far more operationally complex because CloudHSM requires managing dedicated HSM infrastructure. Option B is less desirable operationally because SSE-C requires the customer to provide and manage the keys for every request. Option D is incorrect because SSE-S3 uses Amazon S3 managed keys, and customers do not get the same granular control over key usage by specific employees. Therefore, the least-effort and best-governed solution is SSE-KMS with restricted KMS key access. This aligns with the study guide’s security-and-governance focus on using AWS KMS when controlled access to encryption keys is required.