Programmatically calling AWS using the CLI, SDKs, or direct API requests is correct because IAM access keys are meant to authenticate nonconsole requests so scripts, applications, and continuous integration jobs can sign API calls without a web browser.

IAM access keys consist of an access key ID and a secret access key and they are used by the AWS CLI, SDKs, and custom code to cryptographically sign requests. These keys are intended for programmatic use and they should be stored securely rotated regularly and replaced by temporary credentials such as IAM roles or STS when possible.

Signing in to the AWS Management Console is incorrect because interactive console sign in uses a username and password or federation through single sign on and it does not use access keys for web based authentication.

Validating the integrity of AWS CloudTrail log files is incorrect because CloudTrail integrity validation uses digest files and cryptographic verification methods and that process does not rely on IAM access keys.

AWS Certificate Manager is incorrect because ACM issues and manages TLS certificates for securing network traffic and it is unrelated to IAM access keys which are used to authenticate API requests.

Full AWS Practitioner Certification Question