A city security team creates a new Vault master key for permit arch…

Question

A city security team creates a new Vault master key for permit archives and must choose protection mode. Which statement is accurate?

Accepted Answer

Choose HSM or software at create time; HSM-protected material stays on the HSM for crypto work, while software-protected keys can be exported for client-side use—and the mode cannot change later. — Pick HSM or software when the key is born—that choice sticks. HSM keeps the work on the HSM; software keys can be exported for client-side crypto. Pricing and exportability follow the mode.

Answer

Protection mode can be flipped freely between HSM and software after the key is created with no recreate.

Answer

Software-protected keys never encrypt anything and exist only as display labels in the console.

Answer

HSM mode is available only through Dedicated KMS and cannot be selected on a standard vault key.

A city security team creates a new Vault master key for permit archives and must choose protection mode. Which statement is accurate?

Short Explanation

Full Explanation