An auditor requires lock-lab cryptographic keys in a single-tenant FIPS-validated HSM pool rather than a multi-tenant software-protected key. What should the security engineer recommend?
Select an answer to reveal the explanation.
Short Explanation
If the auditor wants a single-tenant FIPS HSM pool, point them at Managed HSM—or at least HSM-backed keys in Premium when that’s enough. Standard software keys won’t satisfy that bar.
Full Explanation
When an auditor requires cryptographic keys in a single-tenant FIPS-validated HSM pool rather than multi-tenant software-protected keys, Azure Key Vault Managed HSM is the service built for that bar. Premium vaults can also hold HSM-backed keys, which may meet requirements that distinguish HSM-backed from software-protected keys without demanding a dedicated Managed HSM pool. Standard Key Vault software-protected keys do not satisfy a single-tenant FIPS HSM-pool mandate for the lock-lab estate.
Claiming a Standard Key Vault with software-protected keys only because HSM options are unavailable fails by concept—HSM-backed keys and Managed HSM exist. Storing RSA private keys in an NSG flow-log account with public blob access fails confidentiality and has no HSM properties. Disabling purge protection so HSM keys can be exported in cleartext for offline HSMs fails: purge protection is a deletion safeguard, and Managed HSM/key design is not “export private keys to cleartext for convenience.”
Exam caveat: know Standard (software) versus Premium HSM-backed versus Managed HSM single-tenant pools—the exam distinguishes protection levels by product. Operational check: map the auditor’s exact wording (HSM-backed vs single-tenant FIPS pool), select Managed HSM or Premium HSM-backed keys accordingly, create keys in that boundary, and document that Standard software keys were rejected for non-compliance.