Which AWS service can a company use to manage encryption keys in the cloud?

AWS CloudHSM is the correct answer because it provides hardware security modules (HSMs) in the AWS cloud, allowing you to generate and manage your own encryption keys using FIPS 140-2 Level 3 validated hardware. This service is designed for applications requiring strong key management and cryptographic operations. AWS License Manager helps manage software licenses from vendors like Microsoft and Oracle, not encryption keys. AWS Certificate Manager (ACM) provisions, manages, and deploys SSL/TLS certificates for use with AWS services, which are different from general-purpose encryption keys. AWS Directory Service allows you to set up and run directories in the AWS cloud or connect your AWS resources with an existing on-premises Microsoft Active Directory, but it does not manage encryption keys.