A cloud provider's architect needs hardware to generate and protect thousands of tenant master keys with tamper-resistant, high-throughput cryptographic operations. Separately, each hypervisor host must record measurements of its own boot components. Which pairing is correct?

A hardware security module is a dedicated, tamper-resistant cryptographic appliance designed to generate, store and use large numbers of keys at high throughput, with role separation and typically FIPS 140 validation. A key management service backed by a clustered, network-attached HSM is the standard way to protect tenant master keys and to wrap data encryption keys for many customers. A Trusted Platform Module is a low-cost chip, or firmware equivalent, bound to a single platform. Its platform configuration registers record hashes of firmware, boot loader and kernel as the system starts, and it can seal secrets to that measured state and sign attestation quotes. Placing tenant master keys in individual host TPMs fails on scale and performance and ties keys to one machine, so a host failure or replacement strands them. A central HSM cannot observe a remote host's boot sequence; measurements must be taken locally as each component loads. A software key vault on the hypervisor lacks hardware tamper resistance and exposes keys to anyone who compromises the host, which defeats the purpose of hardware protection. Using the TPM for both roles ignores its limited storage and slow operations. Exam caveat: the 2026 outline lists HSM and TPM together under hardware-specific security configuration. Operational check: confirm that master keys never leave the HSM in plaintext and that every host reports TPM measurements on boot.