A payment processor requires that cryptographic keys be generated and stored in dedicated, tamper-resistant hardware, with signing operations performed inside the device so the keys never leave it. Which tool meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
A hardware security module is a vault that does the work inside the vault. You hand it data to sign, it hands back a signature, and the key never comes out. Every other choice here leaves the key sitting somewhere it can be copied.
Full Explanation
A hardware security module is a dedicated, tamper-resistant device that generates, stores, and uses cryptographic keys within its protected boundary. Applications send data to the HSM and receive results such as signatures or decrypted session keys, but the private keys themselves are never exported in usable form. HSMs provide physical tamper resistance, strong access control, and audit logging, which is why payment, certificate authority, and code-signing environments rely on them. An encrypted key file on the application server still requires the key to be loaded into server memory for use, and the file and its decryption secret are exposed to anyone who compromises that server. A password manager vault stores secrets for people and is not designed to perform cryptographic operations internally; anyone retrieving the key can copy it. Key escrow keeps copies of keys with a trusted party for recovery; it addresses availability of keys, not the requirement that keys never leave protected hardware, and it creates an additional copy rather than confining the key. Exam caveat: a TPM is a related hardware root of trust built into individual devices, while an HSM is a dedicated appliance or card serving applications and services at scale. Operational check: confirm keys were generated inside the HSM, review its access roles and quorum settings, and verify audit logs capture every signing request.